MFA result reuse with Duo.

[Scott Koranda]

> I think there might be another way though. There's an
> obscure setting that addresses an issue with the IdP
> processing lists of requested AuthnContext classes and
> whether it does SSO even if a higher priority class in the
> list doesn't get handled. For example, if you request MFA or
> Password, and there's an active result for Password, it can
> be configured to still run the MFA method before reusing
> Password. It's idp.authn.favorSSO or something like that.

Yes, it is idp.authn.favorSSO (I am looking at idp.properties
right now...).

So you are suggesting that by setting

idp.authn.favorSSO=false

AND

configuring a relying party for a particular SP to "request"
"MFA" OR "Password" (in that order!) then the IdP will see it has an active 
"Password" but because idp.authn.favorSSO=false it will go
ahead and run the MFA flow?

And by doing so the MFA flow logic has a chance to "fire"?

Sorry to be pedantic, but I want to be sure I understand.

Thanks,

Scott K