3.2.x and Earlier Login Switching

[Cantor, Scott]

> I need to perform MFA for a specific application with a specific group of
> users.  The IdP must be able to indicate that MFA was used.
> What is the most elegant way to do that?  e.g. wrap part of the Webflow with
> a decision-state that pulls something out of the login context, or... ?

The most elegant way with the older version is what I did for Duo, but I didn't have to solve the user lookup problem, so I didn't have as hard a time.

You build a new flow that's in charge of managing both factors, and starts by determining if it needs to run the first factor or not. It calls the first factor flow itself (Password usually), and then does the rest of its work to decide whether to elevate, and then do the second factor work if it needs to. It's relatively clean except for all the game playing with the Principals to get the right results in each case.

It handles step-up easily because the only time the flow runs is if the first factor was never done or because the request can't be satisfied by it. Otherwise the IdP short-circuits it and just reuses the result for SSO. So it works like you'd think, it does Password normally but if you request MFA it does both or the second alone depending on what was already done.

I would not hold it up as a great example now because it's all been replaced for 3.3, but the Duo flow I did is here [1] (I think it's anon cloneable via git, but the web link itself isn't public). It would work for any two factors more or less.

-- Scott

[1] https://code.osu.edu/cantor.2/idp3-osu-ext.git