Flow filtering based on negation

[David Langenberg]

Hi,

I'm trying to tackle a problem in my setup whereby the Duo login flow doesn't support non-browser and thus causes ECP to fail for users forcing Duo.  So far I've created a new flow (based on the password flow) for ECP and setup the necessary configuration so that everything works nicely for the ECP users whether or not they're forcing Duo.  My problem now is that this ECP flow is being considered for browser-based logins causing both the initialAuthn to fire as well as ECP (for users forcing Duo) resulting in double login.  I see that there's a way to tell the IdP that a particular flow will work for non-browser logins, but there doesn't seem to be a way for me to say ECP flow should never be considered for a browser-based login.  Do I need to file an RFE or am I missing something obvious?

Thanks

Dave

--
David Langenberg
Identity & Access Management Architect
The University of Chicago