IDP 3.3 MFA flow -- checking to see if an authn context class ref was requested

[Cantor, Scott]

> Our specific case is based on:
> (1) not everyone has Duo tokens yet, so I can't just make a simple MFA flow
> of always do password then Duo

I understand that it's conditional based on the user.

> (2) Some SPs will request Duo, others will request Duo or Password in that
> order, others won't request anything in which case password is sufficient for
> now.

Requesting Duo or Password together is really the same as requesting nothing, in essentially all the cases you're thinking about, because those are the only two methods on the table here. That's the only point I'm trying to make.
 
> In the case where either Duo or Password are requested, the isAcceptable
> method will work. But if both are requested by the SP, won't isAcceptable
> always return true once the user has satisfied password? If so, Duo will never
> happen.

I'm saying if you want it to happen anyway, you probably want it to happen based on the user being enrolled or being in some category, not based on the SP. Most SPs request nothing. If you don't force Duo for them, you're gaining nothing all that significant by forcing it in the tiny set of cases where an SP requests both, and you lose out on a lot of additional use of MFA.

-- Scott