Where to put multifactor flows

[Marvin Addison]

>
> What I was proposing was a property (or possibly multiple properties) that
> would influence how the initial-authn step behaved. It would default to
> ignoring the RequestedPrincipalContext (or possibly I would use the
> property to control whether to populate it yet), but you could turn it on
> so that both runs through the authn flow behaved similarly, just with a
> different set of login flows.
>

I thought about this further and attempted to implement it. Here's the diff:

https://gist.github.com/serac/fa70a104deaf314a4592

Initial testing indicates it works as desired for our case, namely, that we
do _not_ get initial password authn for SP requests that are satisfied by
our X509 handler. I hope to wire in the Unicon Duo extensions in the next
couple days and see whether I can get this all this working as needed to
meet our requirements.

I would appreciate your feedback on the patch. Seems pretty
straightforward, but I would be interested to see whether it's complete
from your perspective.

M <dev-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150721/ef02acc7/attachment.html>