Where to put multifactor flows

[Marvin Addison]

>
> One improvement that did occur to me would be to change that up a bit so
> that the RequestedPrincipalContext always gets populated up front, but we
> toggle on or off whether to honor it with more flexible settings. That way
> different use cases could be accomodated at the different stages, and the
> request details would still be pulled out and chewed on consistently.
>

I've been considering this suggestion while studying the Duo work done by
Unicon. I believe we could use it as-is provided we had a mechanism to
prevent the initial-auth step under some circumstances. Since we're already
driving our non-password flows via RequestedPrincipalContext, it seems to
make sense to use that as a switch to conditionally perform initial-auth as
well. I don't have a clear picture what you have in mind, but it seems like
it would meet our needs. If you think it would work, how could we move
forward?

M <dev-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150714/eda64386/attachment.html>