Advice on migrating SPNEGO to MFA-flow

[Cantor, Scott]

> But I already have a question as SPNEGO + multifactor flow fails because of
> the subject c14n when the MFA-flow finishes.
> SPNEGO produces a subject like 'username at domain.com' which has to be canonicalized to
> 'username'. I have 2 c14n active: c14n/attribute & c14n/simple.
> When I only use one factor the c14n works, but if I add the 2nd factor, c14n fails.
> I think c14n/simple won't run because it finds multiple subjects, after MFA-
> flow merged the results:

Not multiple Subjects, multiple UsernamePrincipals. There's only ever one Subject being operated on by that layer, but the "simple" option has limitations. It may be possible to do some enhancing to handle certain cases more gracefully, like if you have multiple UsernamePrincipals but they all have the same value. But at the moment it's just where you do the messing around, building a custom merge or a custom c14n flow.

> Do I need to write my own merge strategy for this?

That's one option. When I did the Duo flow, I avoided this by authoring it to avoid the creation of a second UsernamePrincipal, I had it create a DuoPrincipal. This was one reason, though I also thought it was a little more clean to have the technology represented in the Subject. I would ask what your second factor flow is doing, and maybe you can adjust it to behave differently.

> Why doesn't the MFA-flow user the principalnames that already have been
> canonicalized?

For one thing, there's no requirement that they match. After the merge, you have a totally fresh Subject that could have undergone any amount of manipulation. The final c14n step is just like the end of any login flow, it takes a fresh look at the result and produces the outcome. That might not even be the same as the value(s) that the internal flows produced. It's just layering and retaining flexibility.

Again, optimizations are probably possible to automate more of the cases, but when I'm doing a design this complex, I'm not focused on the common cases sadly, I'm forced to focus on all the exotic ones and make sure it doesn't break things.

-- Scott