Multi-Context Broker functionality in Shibboleth v3 - Comments please.

[Cantor, Scott]

On 4/23/15, 6:33 PM, "David Walker" <dhwprof at gmail.com> wrote:


>So, in 
>https://wiki.shibboleth.net/confluence/display/IDP30/AuthenticationConfigu
>ration it says:

I added that yesterday in response to the conversation here.

>Am I right in assuming that if a site configures authentication flows to 
>return "ReselectFlow", rather than failure, then David Bantz would get 
>the effect he wants?  That is, the IdP would continue to prompt the user 
>for authentication and not return to the SP?

No. That causes it to move on to the next eligible login method to 
attempt, and if there is none, it fails (either locally or with a response 
to the SP). It isn't going to keep retrying failed methods.

People using password forms never leave that particular flow. They keep 
entering passwords and it keeps returning an error, endlessly, just like 
today and on pretty much every login interface one sees.

>Adding a "Get me out of here!" button that returns failure would address 
>the original intent of the MCB's counter, but it wouldn't be necessary.

Yes, it addresses that kind of case.

-- Scott