IdPv3 and subject canonicalization

[Michael A Grady]

For post login subject canonicalization, if I want to use the attribute-based one, I know I need to:

 - enable (uncomment) in conf/c14n/subject-c14n.xml
 - configure in conf/c14n//attribute-sourced-subject-c14n-config.xml

But do I need to comment out (disable) the c14n/simple flow at the same time?

And, in looking at the system flows, I see that this subject canonicalization is configured to occur after a configured "initial authentication".  That means that if I've used "initial authentication" to get username/password to occur before calling Duo, that the attribute subject canonicalization will have already occurred before invoking Duo, correct?

--
Michael A. Grady
IAM Architect, Unicon, Inc.