Where to put multifactor flows

[David Walker]

Exactly.  That does mean, though, that all users must login with
username/password (or some other designated method) before anything
else.  Usually not a problem.

David


On 07/07/2015 09:05 AM, Cantor, Scott wrote:
> On 7/7/15, 11:47 AM, "dev on behalf of Etienne Dysli-Metref" <dev-bounces at shibboleth.net on behalf of etienne.dysli-metref at switch.ch> wrote:
>
>> On 07/07/15 17:31, David Walker wrote:
>>> What you'd really like is a special kind of "second factor only" flow
>>> that has prerequisite flows, but (as Scott said) that's a lot of
>>> work.
>> A simple implementation for this would be to set Password as the initial
>> flow then let the IdP decide whether another "second factor only" flow
>> should run according to the requested authn context class.
> That's basically how I designed things to work, yes.
>
> -- Scott
>