make forceAuthn requests completely start over

[David Langenberg]

On Fri, Jul 31, 2015 at 4:59 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 7/31/15, 6:53 PM, "users on behalf of David Langenberg" <
> users-bounces at shibboleth.net on behalf of davel at uchicago.edu> wrote:
> >
> >Yeah, we don't want to do that as it would lead to a user having to enter
> their password twice to authenticate (once for the initial flow & once for
> the Duo flow).
>
> That's a function of how one implements such a flow, and that isn't how
> one would want to implement it.
>
> In this particular case, though, I would argue this is a bug in the Duo
> flow in the sense that if it's going to "support" ForceAuthn, it needs to
> look for this case and either fail, or somehow get the Password flow to
> run. That's a cost to a strategy of not handling the password half itself.
>

Looks like I'm going to be learning more about SWF this weekend.

Thanks,

Dave


-- 
David Langenberg
Identity & Access Management Architect
The University of Chicago
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150731/1fe4301c/attachment.html>