AuthenticationContext persistence

[Cantor, Scott]

On 8/29/16, 9:07 PM, "dev on behalf of Klingenstein, Nate" <dev-bounces at shibboleth.net on behalf of nklingenstein at calstate.edu> wrote:

>    > I don't know what you mean by "initial".
    
>    # Regular expression of forced "initial" methods when no session exists,
>    # usually in conjunction with the idp.authn.resolveAttribute property below.

Oh, initial authentication. No, just ignore it. I'll get the property out of the default file before we ship it, it's just a compatibility feature now and will probably get tossed in 4.0.

All it is is a copy of authentication that runs any time no IdPSession exists. It lets you do a password step, lookup user data, and then do things based on the user, or if there's already an IdPSession, it skips ahead to the "lookup user data and then do things" step since it already knows who the user is.

The MFA flow does this much more cleanly and renders that feature moot.

-- Scott