Distinguishing SSO from login with initial auth (3.2.1)

[Christopher Bongaarts]

I'm trying to add some logging of auth events to our IdP (3.2.1) at the 
behest of our security folks.

I've added login success/failure for username/password form submission, 
but I'd also like to log something when SSO is used instead.  However, 
we're using initial auth (password) in order to support Duo auth.

Since the initial auth works by always trying a method (password in our 
case) first, and setting that result in a session, the main auth flow 
treats "real" SSO and password success the same - in both cases they 
reuse an existing auth result and SelectAuthenticationFlow returns 
"proceed".  Also, the attempted auth flow is empty.

Is there another way that e.g. an Action running within the standard 
auth-flow could identify whether an auth result is due to "real" SSO 
from the initial flow, or a password auth from the initial flow?

I don't want to log the SSO "success" from within the initial-authn-flow 
since it only checks for an active session; it is authn-flow that 
actually decides whether to use any of the auth results from the session.

I think I can work around this by setting some sort of state in the 
initial-authn-flow to tell whether it just passed along the session, or 
if it actively prompted the user for username/password, though I'm not 
sure where (perhaps a custom subcontext attached to the 
profileRequestContext, but maybe that's overkill?).

I expect this to be easier in 3.3 when we're able to ditch the initial 
auth construct...

Any suggestions?

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%