Where to put multifactor flows

[David Walker]

Thanks, Marvin.  One final comment below...

David


On 07/15/2015 01:06 PM, Marvin Addison wrote:
...
>  
>
>     What if Marvin's Password login screen had a button to invoke
>     X.509 authentication (and was the initial-authn)?
>
>
> That's actually a step backward. The RequestedPrincipalContext
> machinery works great for driving the user to the proper login process
> based on SP requirements. That's not to say we can't do what you
> suggested, but it would trade Duo functionality for a lesser user
> experience. I'm hopeful we can get the functionality we need without
> that tradeoff.

Oh well.  I may mention it in the MCB-related documentation, though, as
a technique for sites that don't have a history of supporting X.509 and
other technologies that require little or no interaction.  They won't be
as sensitive to the extra click, it becomes an extension of the login
screen they already see, and it seems easier to implement.  It also
means that people with tokens never have to type their user name and
password, as they can select X.509 even when the first SP doesn't
request it.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150715/3d1152ef/attachment.html>