Bug in handling user certifications for specific contexts?

[Wessel, Keith]

I suggested yesterday on the call that I had with the two Davids that it'd be nice if there was some way the IDP could be configured to know that before running Duo (or some other 2nd factor method), it must run password explicitly. Password, of course, could be any other valid first method such as if one wanted to use X509 certs. While we've been able to achieve MFA by setting the initial flows property to Password, this is a bit of a hack and, as is pointed out with the issue described in this thread, becomes a problem.

Is there anything that can be done (or added) to tell a flow to first run another flow to get the needed principal before proceeding?

Keith


-----Original Message-----
From: dev [mailto:dev-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, September 08, 2015 7:23 PM
To: Shib Dev <dev at shibboleth.net>
Subject: Re: Bug in handling user certifications for specific contexts?

On 9/8/15, 8:19 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:



>I think there will be unintended consequences to virtually every change from here on out.

Though of course the only possible consequences here are prompts to login more frequently than intended based on blocking reuse of a result.

-- Scott

-- 
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net