MFA result reuse with Duo.

[Cantor, Scott]

On 1/18/17, 4:46 PM, "users on behalf of Scott Koranda" <users-bounces at shibboleth.net on behalf of skoranda at gmail.com> wrote:

> So you are suggesting that by setting
> 
>  idp.authn.favorSSO=false
> 
>  AND
> 
>  configuring a relying party for a particular SP to "request"
>  "MFA" OR "Password" (in that order!) then the IdP will see it has an active 
> "Password" but because idp.authn.favorSSO=false it will go
>  ahead and run the MFA flow?

I was using Password and MFA as stand ins for context classes corresponding to the Password and Duo flows, but otherwise yes, I think so.

The 2.x IdP had a semi-incorrect behavior such that it would prioritize SSO over processing the requested classes in order, which is technically not SAML compliant. 3.x doesn't promise to be totally strict but it does have this option to turn off that priority rule since I decided we should try and be more correct at least optionally.

So what it does is check each requested Principal in sequence, and determine if it can be satisfied. If not, it looks for a flow to run that supports it. So I think it will run the MFA flow (which will support both/all of course) in such cases before it sees the second Principal and decides to reuse the old result.

-- Scott