Possible bug with defining AuthenticationFlows in relying-party.xml

[Cantor, Scott]

On 1/5/16, 6:39 PM, "users on behalf of Travis Schmidt" <users-bounces at shibboleth.net on behalf of travis.schmidt at gmail.com> wrote:



>It looks like removing the initial works for me.  So without it, will the order of flows chosen be how they are listed in the reg ex or the order in general-authn.xml?

The list in general-auth is ordered, and the filtering that happens removes items but doesn't change that order. The regex is purely a regex, not any kind of precedence. Using the pipes is just convenient/concise.

I don't know enough of your full picture to know if that's workable for you. The initial-authn feature is mostly there to address the case where some users don't have or use the second factor so you can identify that before it runs, and because just specifying the second factor flow means the first one doesn't get a chance to run.

As I said in another thread, this whole situation was just not part of my design. Composing flows to create the whole result was explicitly out of scope very early on, so the most effective Duo flow today is one that contains or calls the Password half with all the attendant logic for doing so inline. Having the IdP orchestrate it today is troublesome.

-- Scott