Authn Error - IdP v3

[Pradeep Jamble]

Got it. I realize that the purpose of that feature was not to combine and
orchestrate multiple authn flows. I tried to setup X509 as the first factor
and then RemoteUser authn as the second factor but it just pulled the user
identity from the existing session and didn't prompt the user again. I was
looking for a way to force the authn but I now understand from your
statement that it's not designed to do that.

I'm going to look at the auth flow documentation and see if there's a way
to build something to match the use case. Thanks Scott!

On Mon, May 9, 2016 at 2:22 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > My bad Scott, apologies. I was looking in the wrong place. I didn't
> realize the
> > properties were mutually exclusive.
>
> They're not mutually exclusive, they're overlapping, which is why it's an
> ugly little feature. It's just a stopgap. But it doesn't make sense to use
> it with certificates.
>
> > Regarding, X509 as initial authn, I'm just testing a use case where we
> want to
> > use certs for primary authn followed by another factor. That's where I
> was
> > trying to replicate the MCB stuff based on one of the documents in the
> wiki.
>
> No, that won't do what you want. The initial-authn thing only runs then
> there's no session and it's just skipped entirely at any other time because
> the user identify it pulled out of the session.
>
> I can't do much besides acknowledge that combining factors isn't really a
> feature it provides. It just wasn't a requirement for the first releases.
> The requirement we had was for *selecting* different factors, not combining
> them. 3.3 will provide a method to combine them.
>
> But there is documentation on authoring login flows and of course there're
> the existing flows to copy and adapt.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160509/f4e3ab28/attachment.html>