RemoteUser authnMethodHeader example?

[Cantor, Scott]

> I've got an attribute that our SSO sets that says what authentication factors
> have been satisfied. I could conditionally set headers based on what's there.

Right, but the point is that the RemoteUser flow doesn't succeed or fail based on anything but the identity being there or not. I clarified that in the docs. It doesn't give you the ability to fail it at the end because of some other header. So as far as I can see, all it will do is run the first of those flows and succeed, the others are basically invisible to it.

If you conditionally set REMOTE_USER or an identity header based on another header, then perhaps you could make them fail in specific cases to get them all to run.

> I could try collapsing the token and "plus" flows into the existing RemoteUser flow.

I would guess that would be a much better starting point to work from.

> What would you suggest?

I don't have a full picture of the requirements, but the IdP is very limited in its orchestration. Anything more than a couple of non-overlapping methods is best handled with the MFA flow and custom rules to control what it does.

-- Scott