MFA Transition nextFlowStrategy-ref question IdP3.3.0

[O'Dowd, Josh]

Thanks Jim,

Not a bad idea, requires repeating some logic between strategyA and strategyB, though, where flow3 is concerned.  Not ideal, but it works.

Josh

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Jim Fox
Sent: Wednesday, December 21, 2016 1:57 PM
To: users at shibboleth.net
Subject: Re: MFA Transition nextFlowStrategy-ref question IdP3.3.0

After flow1 run strategyA, which returns flow2, flow3, or null.
After flow2 run strategyB, which returns flow3 or null.
Jim
________________________________________
From: users <users-bounces at shibboleth.net> on behalf of O'Dowd, Josh <Josh.O'Dowd at mso.umt.edu>
Sent: Wednesday, December 21, 2016 12:19:02 PM
To: users at shibboleth.net
Subject: MFA Transition nextFlowStrategy-ref question IdP3.3.0

I don't want to seem like a weekly pest, which would be understandable given my activity on this forum over the past few weeks, but...

I have 2 "potential" secondary factors in our MFA, both of which require decision logic to determine 'flow', or 'no-flow', and the second does not depend on the first.  In other words, the authentication factors could go 1st-2nd-3rd, 1-2, 1-3, or just 1.  My initial though was to find out if I could have a nextFlowStrategy return a flow id OR another strategy-ref.  But that doesn't work.  Or should it, and I just didn't do it right.  I didn't find that kind of available functionality in the MFA docs.

So the transitioning logic looks like (where flow#1 is the entry flow):

*         IF flow#1 THEN strategy-A

*         strategy-A:  IF true THEN flow#2 ELSE strategy-B

*         IF flow#2 THEN strategy-B

*         strategy-B: IF true THEN flow#3 ELSE null to end MFA

It would be nice if a strategy could reference another strategy, but I am looking for a "clean" alternative idea.

Thanks for the time.  Merry Christmas to you guys!

Josh O'Dowd
Software Systems Engineer / Identity Access Management Central IT, University of Montana

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net