IDP 3.3 MFA flow -- checking to see if an authn context class ref was requested

[Cantor, Scott]

Coincidentally I'm working on redoing my Duo integration using this code now, and I realized I was a little off with my suggestion, though the correct way is illustrated by the example script we shipped. The way you want to check if the factor(s) already completed are sufficient is with the MultiFactorAuthenticationContext's isAcceptable() method, it's a simpler check and it checks all the results for you plus handles ForceAuthn (by ignoring non-fresh results).

The sort of canonical handoff script (with Duo, or substitute anything else) is:

    <![CDATA[
        nextFlow = "authn/Duo";

        // Go to second factor if we have to.
        authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
        mfaCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");
        if (mfaCtx.isAcceptable()) {
            nextFlow = null;
        }

        nextFlow;   // pass control to second factor or end with the first
    ]]>

Same as the example shipped, just without the attribute resolution illustrated.

I think at one point that was sort of abstracted out into a default behavior that I was calling a "completion function" but because so many people use all these complicated rules, I decided to make it a bit explicit and the people with the simple case (like, say, me) can just use a trivial script like that.

-- Scott