make forceAuthn requests completely start over

[Cantor, Scott]

On 7/31/15, 6:53 PM, "users on behalf of David Langenberg" <users-bounces at shibboleth.net on behalf of davel at uchicago.edu> wrote:
>
>Yeah, we don't want to do that as it would lead to a user having to enter their password twice to authenticate (once for the initial flow & once for the Duo flow).

That's a function of how one implements such a flow, and that isn't how one would want to implement it.

In this particular case, though, I would argue this is a bug in the Duo flow in the sense that if it's going to "support" ForceAuthn, it needs to look for this case and either fail, or somehow get the Password flow to run. That's a cost to a strategy of not handling the password half itself.

-- Scott