Principal Adding

[Cantor, Scott]

> Which use cases does the new MFA flow not satisfy that the existing
> implementation does?

The MFA flow doesn't actually *do* authentication, so that depends on what exactly you have to do. The existing Password flow still does what it does, and if you need to mix a bunch of different validation steps with one login form, there's no way to do that with the MFA flow by itself. But most people don't need that, they're combining a simple Password step with some other simple thing like Duo and the tricks come from when they have to do them.

Also, the MFA flow lets you attach the right set of custom Principals to each individual flow, and then let the flow produce its result per usual and it does the final mixing at the end, so if you have to screw around with the results, that's a much cleaner way to do it then to try and fool the Password flow into doing strange things to its results.

With the MFA flow, the Password flow "supports" PPT and the Duo flow "supports", well, whatever context class you want to use with it, and the right things happen without having to set addDefaultPrincipals to false. That's all I'm saying.

The only trick is that the MFA flow has to "support" both context classes since it has to get the IdP to run it in both cases, but that's not a high price to pay.
 
> Is there an implicit release timeframe in here?

Nov 1. It will be before Thanksgiving no matter what because I'm not going to spend my time off working on this.

>  Do nightly snapshots build unless someone says I broke it?

If the tests all pass its very unusual that anything very wrong is happening in any of the core code, but it's still a snaphot and if you really want to pull one, it's simplest to just ask if things are in a stable place. Right now things are pretty static as far as I'm aware.

-- Scott