MFA Transition nextFlowStrategy-ref question IdP3.3.0

[Jim Fox]

After flow1 run strategyA, which returns flow2, flow3, or null.
After flow2 run strategyB, which returns flow3 or null.
Jim
________________________________________
From: users <users-bounces at shibboleth.net> on behalf of O'Dowd, Josh <Josh.O'Dowd at mso.umt.edu>
Sent: Wednesday, December 21, 2016 12:19:02 PM
To: users at shibboleth.net
Subject: MFA Transition nextFlowStrategy-ref question IdP3.3.0

I don’t want to seem like a weekly pest, which would be understandable given my activity on this forum over the past few weeks, but…

I have 2 “potential” secondary factors in our MFA, both of which require decision logic to determine ‘flow’, or ‘no-flow’, and the second does not depend on the first.  In other words, the authentication factors could go 1st-2nd-3rd, 1-2, 1-3, or just 1.  My initial though was to find out if I could have a nextFlowStrategy return a flow id OR another strategy-ref.  But that doesn’t work.  Or should it, and I just didn’t do it right.  I didn’t find that kind of available functionality in the MFA docs.

So the transitioning logic looks like (where flow#1 is the entry flow):

·         IF flow#1 THEN strategy-A

·         strategy-A:  IF true THEN flow#2 ELSE strategy-B

·         IF flow#2 THEN strategy-B

·         strategy-B: IF true THEN flow#3 ELSE null to end MFA

It would be nice if a strategy could reference another strategy, but I am looking for a “clean” alternative idea.

Thanks for the time.  Merry Christmas to you guys!

Josh O’Dowd
Software Systems Engineer / Identity Access Management
Central IT, University of Montana