authn/noop flow?

[Cantor, Scott]

On 2/3/17, 3:25 PM, "dev on behalf of Scott Koranda" <dev-bounces at shibboleth.net on behalf of skoranda at gmail.com> wrote:

>  I don't want the IdP to lie, but I do want the MFA flow to be
>  able to decide using my strategy map that it should when it is
>  all done assert an MFA principal. A concrete example might be
>  the MFA strategy map looking at an IP address that indicates
>  that the user is on the VPN and the VPN requires MFA so we
>   want to assert MFA (after doing authn/Password of course to
>  know which user...).

I was envisioning that you'd do that by providing a custom "merge" function that computes the final answer. That function can pretty much entirely replace the final Subject and its contents.

>  For such a use case an "authn/noop" flow that can be
>  configured to assert the MFA principal would be handy.  It
>  would just do what authn/duo does in terms of the subject.
>   
> Can that be considered for the next release?

I don't know if it would be a ton easier, and might be more confusing for some, but I'll consider I guess.

-- Scott