Possible bug with defining AuthenticationFlows in relying-party.xml

[Cantor, Scott]

> Yes, so I have
> idp.authn.flows= Password|Duo|PwdDuo
> 
> and
> 
> idp.authn.flows.initial = Password

Yeah, so I would imagine initial is breaking. The same winnowing occurs at both points, so you have it directing the profile to use a method that's not active. You really can't combine the initial login method feature with a lot of the rest of the options without ending up with problems. Just wasn't a well-thought out feature, I implemented it as a half-step to support some of the things people demanded that I knew wouldn't work otherwise.

I think it's questionable that the initial login flow is honoring the authenticationFlows property. I reviewed the code and was a bit surprised it was doing that.

-- Scott