Duo IdPv3.3 c14n null principal.

[Cantor, Scott]

> So you are suggesting that if I also set that password in to the UPC and exit
> state back to ValidateUsernamePassword, that would effectually
> reauthenticate the user properly without sending them back to the login
> page, correct?

Yes. The Display/Validate steps are decoupled and don't have any interdependencies other than the context, which is under the AuthenticationContext, and there's no reason that would be changing.

The Display is an extraction step to populate the UPC. If something else does that, the Validate step won't know the difference.

Obviously it's less efficient to revalidate and there's the chance that something could fail for some other reason I suppose.

-- Scott