MFA enhancements in 3.3

[Cantor, Scott]

> Thanks for the heads-up Scott. I'll be basing my project on
> 3.3.0-SNAPSHOT then. :)

I'm running that in production, if it helps. There are a ton of small enhancements already done that I needed (e.g. expiring password interceptor).

> For the MFA flows I'm working on, I imagine a "second factor selection
> screen", appearing after password login, where a user could select their
> preferred factor among the ones that are implemented by the IdP and
> active (the IdP could decide to enable/disable certain factors depending
> on the situation). Is that compatible with your design?

Yes, that's part of the motivation. Doing that now is really awkward because of the whole need for "initial-authn" to drive the identification of the user and then do attribute lookup, and it only knows how to filter flows with the attribute, which isn't always the goal.

See my reply to Marvin, but the transitions between "factors" don't all have to be to actual factors. You can have it transition to your page (or flow) instead, and then have your selection process populate something that a custom transition function will look at to decide what flow to run next.

You could also have it do attribute lookups first to include in your selection screen logic, etc.

As long as every flow that runs has a rule configured in the MFA flow to tell it how to proceed to the next step, it should all work without the MFA flow knowing any of the details.

I'll think about whether it's practical to have it issue an externalRedirect transition as a feature or not. Probably would work, I'd have to consider how to represent it. I prefer not to require webflow for everything where I don't have to.

-- Scott