MFA result reuse with Duo.

[Cantor, Scott]

On 1/18/17, 5:03 PM, "users on behalf of Scott Koranda" <users-bounces at shibboleth.net on behalf of skoranda at gmail.com> wrote:

> So presumably the SubjectCanonicalizationContext is not available for some reason?

I think you're just hitting the distinction between "ran Password flow this request" and "reused session". The reason the Duo flow uses a plugin function to get the username is to handle that distinction, it falls back to the existing IdPSession's principal name if there's no c14n context. I think you originally asked me months ago if that was a reasonable algorithm, and that's what I've been going with.

You *can* go digging into previous results and such, but all that stuff can be in different states depending on how things are set up. Remember that the UsernamePrincipal is based on what the user enters, not on the result of c14n. I keep harping on that, but my deployment for example would break based on reusing the UsernamePrincipal's value.

> Can I walk the context tree and find another context from
> which to pull the principal tree? (I assume yes...)

You can, but the IdPSession is a better fallback. If you run Password as a precondition to Duo, then either you have a fresh run, and will find it in the c14n context as before or you're reusing an old result and there will be a session to get it from.

-- Scott