MCB with Duo and password as fallback

[Cantor, Scott]

On 8/20/14, 5:20 PM, "Wessel, Keith" <kwessel at illinois.edu> wrote:

>But I'm hitting a snag. With my authnContextClassRef set to the duo
>context followed by the password context, and my initial context in the
>MCB set only to password, I get prompted to password authenticate. But
>then I never get sent to Duo authenticate, presumably because I've
>already settled the password context.

Isn't your SP asking for Duo first? That shouldn't be satisfiable with a
password...

Or do you mean you're requesting both at the same time?

That seems like a byproduct of favoring SSO over making the best match
with the request, which is really a bug (in V2 alone, don't know about the
MCB), and I coded V3 to include an option to leave that behavior, or
strictly honor the request's preference list and not favor SSO.

-- Scott