Google Authenticator Setup

[Cantor, Scott]

> I enabled it by setting idp.authn.flows.initial = Password|Totp.
> I'm unsure if that is correct, but there wasn't any additional to enable it.

If the extension was implemented to assume that Password runs, then you should enable Password as the initial method and that's it.

> I'm not sure if this is the correct implementation, can someone confirm?

Correct implementation of what? The OATH piece is an extension by somebody else. There isn't an official version, but there will be one at some point in the future. It won't be exactly this one, if that's what you're asking.

> Also based on idp.authn.LDAP.returnAttributes can I determine whether or
> not it runs for the user.

I very much doubt it.

Login flows need to be configured by you with support for the custom Principal sets you want/need and they need to be implemented to populate the Subject they produce with the right ones. That's how all the signaling and support for honoring requested AuthnContext class values works.

Generally, login flows should produce and populate at least one custom Principal that represents that method's specific behavior because that makes it easier for scripts and plugins downstream to detect whether something was done or not. For example, the Duo flow I checked in produces a DuoPrincipal for that purpose.

It is practically impossible that anybody out there producing a custom login flow is doing so correctly, unless they did it within the last few weeks since I even documented a lot of the interface. It's a lot of hacky code produced by reverse engineering code I wrote and nobody by and large ever bothered to ask me how to do it correctly.

-- Scott