Where to put multifactor flows

[Cantor, Scott]

On 7/14/15, 10:08 AM, "dev on behalf of Marvin Addison" <dev-bounces at shibboleth.net on behalf of marvin.addison at gmail.com> wrote:

>I've been considering this suggestion while studying the Duo work done by Unicon.

I haven't reviewed that yet (FWIW).

> I believe we could use it as-is provided we had a mechanism to prevent the initial-auth step under some circumstances. Since we're already driving our non-password flows via RequestedPrincipalContext, it seems to make sense to use that as a switch to conditionally perform initial-auth as well. I don't have a clear picture what you have in mind, but it seems like it would meet our needs. If you think it would work, how could
> we move forward?

What I was proposing was a property (or possibly multiple properties) that would influence how the initial-authn step behaved. It would default to ignoring the RequestedPrincipalContext (or possibly I would use the property to control whether to populate it yet), but you could turn it on so that both runs through the authn flow behaved similarly, just with a different set of login flows.

I would need to figure out the error handling, I think it would need to change a bit since it shouldn't be an error necessarily to not find a flow to run, which normally would be a failure.

I don't know if that's enough to make the feature really useful, but it sounded like a start. I hadn't filed an issue on it yet, you can if you think it's useful.

-- Scott