Custom authn/flow called by authn/MFA

[Cantor, Scott]

On 4/11/19, 10:13 AM, "dev on behalf of Mak, Steve" <dev-bounces at shibboleth.net on behalf of makst at upenn.edu> wrote:

> I'm having trouble getting the username for the authenticated Subject in my custom flow.

net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy

That's used in the Duo flow by default, though it's overrideable (and should always be parametrized by a lookup function like that in any actual code). It relies on a previous login flow having performed subject canonicalization on its result or on the identity in the session from a previous login in the case that SSO is "partially" involved as in a step up scenario because there won't be a result from a previous login flow.

-- Scott