IDP 3.3 MFA flow -- checking to see if an authn context class ref was requested

[Wessel, Keith]

Hi,

Trying to set things up such that, in the case that the SP requests Duo and Password (in that order), my IdP can handle things intelligently. If Both were requested and the user is eligible for Duo, I want to signal Duo. If both were requested and the user isn't Duo eligible, I'll let them through with Password. If the SP didn't request Duo at all, I'll let them through with Password. And if the SP only requested Duo, I'll either send them to a Duo flow or to another flow which displays an error stating they need to enroll for a Duo token.

Two questions:

First, I see I can use the isAcceptable method (as included in the distributed example) to see if a requested method has been satisfied. But I'm curious, in this case, about requested methods that haven't been satisfied - namely Duo. How can I get a list of requested authentication context classes? I've looked at the MFA context and authentication context in the JavaDocs, but I don't see anything to help me in those.

Second, would it be easier for me to not use the MFA flow at all but rather check for Duo eligibility (by checking a user's attribute values) inside my duo.vm? This would avoid needing to check for requested flows as the flow wouldn't even be executed if Duo wasn't requested. I'm just not sure how I would go about checking for an attribute value from the attribute resolver inside of a Velocity template.

Thanks,
Keith