Relying Party User-Agent Predicate

[Cantor, Scott]

On 8/16/17, 1:26 PM, "users on behalf of Klingenstein, Nate" <users-bounces at shibboleth.net on behalf of nklingenstein at calstate.edu> wrote:

> Thanks so much for the feedback.  I don't think I can get away with the above approach since I need to be able to honor MFA in
> either case, right?  The check is going to have to happen within the MFA logic, and I'm still wrestling with that.

There's nothing stopping the MFA rule/script from executing the condition itself against the flow descriptor bean as a way of splitting off the logic of the condition, but that's just a six of one thing, the code's someplace either way. Either way it seems awkward at best and unworkable at worst to try and do it as a relying party condition but I don't really know the use case.

It's certainly not complex to have the MFA scripting look at the user agent to decide what method to run, the hassle of maintaining user agent testing aside.
 
-- Scott