MCB with Duo and password as fallback

[Cantor, Scott]

On 8/20/14, 9:13 PM, "Paul Hethmon" <paul.hethmon at clareitysecurity.com>
wrote:
>
>A given method can be specified to satisfy multiple context values which
>ends up rendering them the same in practice. That is because when a user
>authenticates successfully, they have completed a method. Then any
>context which uses that method can be satisfied.

Yes, but my point is that SAML requires that the IdP try and honor the
requested contexts in the order they're listed. It doesn't qualify that
requirement with "unless a later one can be met without actually
prompting". It's not irrational to take that view, because users are
obviously happier, but it's not actually something the standard would
justify, and SPs routinely get confused when this happens, so it's clearly
not what they want.

In other words, the strict approach is to say, if the SP requests X, and
if X is possible to attempt, you attempt X, even if the user already
completed Y and Y is the second one in the request. Replace X with Duo and
Y with password in this case.

With V3, the flow selection can be configured with either interpretation.
But if V2 hadn't done it the other way, I wouldn't have implemented that,
because the standard is fairly clear about it.

-- Scott