MFA and attribute return

[Richard Frovarp]

I'm trying to figure out my MFA configuration for IdP 3.3.x, and I'm 
having trouble.

I have the MFA check working. attribute-resolver.xml has a scripted 
attribute added to it to make the determination if Duo is required. I've 
set my idp.authn.flows to MFA and updated 
conf/authn/mfa-authn-config.xml to do the check to see if the attribute 
is present. If the scripted attribute isn't set, it doesn't do MFA, and 
if it is, it kicks off to Duo. That works, and so does the follow on Duo 
check.

The problem is if idp.authn.flows is set to MFA, it isn't releasing any 
attributes, despite the fact that it is configured to release 
attributes. If I change that from MFA to Password, it obviously doesn't 
do the MFA check, but it also releases the attributes. No matter what 
that value is, testing via aacli.sh gives back the proper list of 
attributes.

I see in the docs mention of merging principals, but I'm obviously to 
the point where I'm too confused to quite make sense of that. It has to 
be making a username determination to kick off the right username to 
Duo, so that part must be working.

Any help is appreciated.

Richard