authentication flow howto/tutorial

[Cantor, Scott]

> This isnt the first "why did they do that?" ive come across on this
> project. Considering they're closely partnered with EMC i'd Anyway, I
> made this edit in general-authn.xml. If there's another way I should be
> doing this please let me know.

There is. Doing that is causing your IdP to lie. It's telling the application that client TLS was used, which is not true.

You need to report this to the company and get them to stop requesting client TLS.

If you absolutely have to, then the solution is *not* to support that method, it's to configure the comparison logic in authn-comparison.xml so that it evaluates the methods you do support as "less than or equal to" that one.

-- Scott