ECP authentication

[Cantor, Scott]

> Ah, ok. So once I migrate v3 into production, I can just add the ECP endpoint
> into the federation metadata and it will magically just work? Sweet.

Yes. My sandbox is working now for our mobile apps and I didn't do anything whatsoever to make ECP work, it's all defaults. They had a bug (the same incorrectly defaulting Content-Type bug that bit the shell script example) and I did hack around that for the time being with a Java filter.

> Applications using ECP can only do password, but I can have other
> applications do multi factor or other more complicated things without
> breaking the ECP applications?

It really depends how you set things up. Login flows know whether they can run or not for non-browser profiles (ECP being the only one at the moment, but the code doesn't care). Password is labeled compatible but if you change it so that it's not, or deploy another flow that isn't, it has to be marked. If that causes a request to fail because the SP requests something that can't be satisfied by the Password flow, then the result will be as intended.

It "works", but whether it provides a result that's useful is a different issue.

I will eventually end up building or using somebody else's Duo flow that has API support instead of the frame, and that's the sort of thing you need for ECP to work with other methods.

-- Scott