3.3 SNAPSHOT: AuthN resolveAttribute not activating authn flow

[Cantor, Scott]

I think this is the change involved:

https://issues.shibboleth.net/jira/browse/IDP-980

It fits your situation. I will have to review the change to see if anything there isn't making sense to me, but I want to emphasize a point here:

If the request does not contain, either explicitly or via profile configuration, a requirement for how authentication should be done, you cannot make assumptions or try and trick the system into forcing use of particular methods. It's hopeless, fundamentally. It wants to do SSO. If you don't want SSO, then request a principal type that will require some additional step (which you can do dynamically now in 3.3 also). It's really that simple.

I also need to be clear that while it's probably not documented yet, all the stuff you're using is going to be deprecated, either in 3.3 or the next release. It's definitely all gone in 4.0. Initial authn, that attribute hack, all of it. Don't use it once the new version is out. All of that was a horrible mess and I deeply apologize inflicting it on people. Anything using that stuff should be ported to the MFA flow or dumped.

I will be very clear on that in the documentation, it's just not appropriate to do all that prior to release.

Anyway, yes, it changed a number of months back, and no, I'm not 100% sure if I think it's right at the moment or not.

-- Scott