authn/noop flow?

[Scott Koranda]

> Arguably, the use case you mentioned is really one for the
> IPAddress flow itself. If you controlled it sufficiently,
> couldn't you attach the right context class principal to
> that flow and just have your rule run that flow to
> essentially *be* a no-op?
> 
> I guess one problem with that is that it produces a
> UsernamePrincipal that would collide with the Password flow.
> You'd still end up needing a custom merge to strip that
> dummy username out or it would cause hassle downstream.
> Would be easy to maybe add an option to the IPAddress flow
> to control whether to include that principal. Might be more
> useful than a truly no-op flow.

I am going to proceed in this direction and evolve the
IPAddress flow for now.

My initial plan is to add a usernameLookupStrategy option just
like the ValidateDuoWebResponse class has. The default would
be utilizing the mapping as it does right now.

Any other strategy passed in will get the opportunity to set
the username. For my use case I would just pass in the
CanonicalUsernameLookupStategy.

Does that sound reasonable?

Thanks,

Scott K