3.2.x and Earlier Login Switching

[Cantor, Scott]

On 8/29/16, 3:21 PM, "users on behalf of Klingenstein, Nate" <users-bounces at shibboleth.net on behalf of nklingenstein at calstate.edu> wrote:

> I assume this username canonicalization is something I can brute force with the assumption
> that the results of the Password flow will have the Username that I want to do validation
> with against Duo.

That depends on how screwed up your password authentication processes are. We have a half-dozen identifiers they've forced me to accomodate, so my input side is a mess. If you don't have that problem, that helps.

>    Is that horribly wrong, and does it work on return visits, e.g. step-up?

Depends where you're accessing that context. You'd have to get it from the pool of previous results, but honestly I don't know why you would. Just do it the way I did.

-- Scott