Bug in handling user certifications for specific contexts?

[David Walker]

Dave Langenberg, Keith Wessel, and I had a conversation earlier today,
and this came up...

One of the more popular Multi-Context Broker use cases is to enable the
IdP to require that certain users must use multi-factor authentication,
even when the SP doesn't request it.  This requirement may be the result
of the user's preference, or institutional policy.

idp.authn.resolveAttribute can be configured to enable this, but it
appears that it's not always honored.  Here's more detail of what
doesn't work.

 1. Two types of Principles are defined:  Password and Duo.
 2. matchingRules are defined to allow Duo to be used to satisfy a
    request for Password.
 3. idp.authn.flows.initial is set to Password.
 4. The value of the user's value for the idp.authn.resolveAttribute is
    set to only Duo, not Password.


When an SP requests Password, the user should be prompted for Duo
authentication after the initial Password authentication. 
Unfortunately, the IdP returns successful authentication after the
initial Password authentication is complete, without the Duo
interaction.  Sounds like a bug to us; are we missing something?

David

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150908/88c9d42a/attachment.html>