Flow filtering based on negation

[Cantor, Scott]

On 11/13/15, 2:53 PM, "users on behalf of David Langenberg" <users-bounces at shibboleth.net on behalf of davel at uchicago.edu> wrote:



>I'm trying to tackle a problem in my setup whereby the Duo login flow doesn't support non-browser and thus causes ECP to fail for users forcing Duo.  So far I've created a new flow (based on the password flow) for ECP and setup the necessary configuration so that everything works nicely for the ECP users whether or not they're forcing Duo.  My problem now is that this ECP flow is being considered for browser-based logins causing both the initialAuthn to fire as well as ECP (for users forcing Duo) resulting in double login.

You could enable that new flow for only the ECP profile (in the profile config bean's property controlling which flows to allow). I hadn't necessarily anticipated that use, but it works for that.

>I see that there's a way to tell the IdP that a particular flow will work for non-browser logins, but there doesn't seem to be a way for me to say ECP flow should never be considered for a browser-based login.  Do I need to file an RFE or am I missing something obvious?

I guess it's a possible feature, but the non-browser thing was kind of a hack and I'm not in love with adding more and more flags of that nature. But I don't think you need it here.

-- Scott