<html><head><style>body{font-family:Bookerly,Arial;font-size:13px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div><div><br><blockquote type="cite" class="clean_bq" style="font-family: Bookerly, Arial; font-size: 13.020831108093262px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span>I can't say whether it should or shouldn't based on that information. By default, the filtering action applies to both flows and results, meaning it will filter out the Password result if and only if the attribute values don't include a value that matches it.<span class="Apple-converted-space"> </span></span></blockquote></div><p>FWIW, as an experiment I did also try to disable the filtering behavior of authentication results via the relevant property. Made no difference, sadly. <span style="font-size: 13px;">Is that behavior new to 3.3 by the way? Did the filtering of authn results always happen, or 3.3 just makes that configurable, or was that always there and I missed it? </span></p><div><div><blockquote type="cite" class="clean_bq" style="font-family: Bookerly, Arial; font-size: 13.020831108093262px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span><br>That implies that the Password result is not the same as the static description of the Password flow's supported principals. The result must have more inside the Subject in the first case vs the second.<span class="Apple-converted-space"> </span></span></blockquote></div><p>As far as I can tell, the password result in the authn context matches exactly in both cases. </p><div><div><blockquote type="cite" class="clean_bq" style="font-family: Bookerly, Arial; font-size: 13.020831108093262px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;"><span><br>Maybe at least with the password configuration I could take a stab at it. Shouldn't matter that much what the secondary flow is, I just need to set up the primary the way you are and know what the attribute value(s) are for the user.<span class="Apple-converted-space"> </span><br><br>There also seems like a ton of logging elided there.<span class="Apple-converted-space"> </span></span></blockquote></div><p>The setup is fairly simple:</p><p><span style="font-size: 13px;">idp.authn.flows = Password|TB<br></span><span style="font-size: 13px;">idp.authn.flows.initial = Password<br></span><span style="font-size: 13px;">idp.authn.resolveAttribute = requiredAuthnCtx</span></p><p><font size="3">The authn/TB flow is an authentication flow that merges in the default principals plus an authn context class ref of </font><a href="http://example.org/q" style="font-size: 13px;">http://example.org/q</a><font size="3"> for instance. </font><span style="font-size: 13px;">Could</span><font size="3"> be anything. </font><span style="font-size: medium;">The “requiredAuthnCtx” attribute resolves to </span><a href="https://example">https://example</a><span style="font-size: medium;">.org/q</span></p><p><font size="3">If there is anything in particular in the logs that can help diagnose this, I am happy to share.</font></p><div><br class="Apple-interchange-newline"></div></div></div></div><br></body></html>