Best place in IdP SSO login flow to allow users to choose issuer of assertion

[Cantor, Scott]

On 6/6/17, 6:00 AM, "users on behalf of Daniel Lutz" <users-bounces at shibboleth.net on behalf of daniel.lutz at switch.ch> wrote:

> - If we implemented the selection step as part of an MFA flow (e.g. as second step
>  after the Password login flow), would there be an easy way to force running the
>  selection step during each execution of the SSO login flow?

3.3 doesn't have a built-in way of bypassing SSO. The workaround of using ordered AuthnContextClassRefs in a request really just works for second-factor cases. I already added a condition property to control SSO to all the login flow descriptors, so it's fixed in 3.4 and you can coordinate everything through the MFA rules on every request but that doesn't help you now.

> Do you see a chance that you would add some possibility to allow deployers
>  to add an optional step (subflow) between authentication and attribute resolution?
> (I guess that our use case would be the only one.)

If the point is that you need to know the identity of the issuer during resolution, then you can simply let it run, run a post-authn interceptor, and have that interceptor clear the resolved AttributeContext state and re-run the attribute resolution and filtering steps after the user selects the issuer. The system hasn't done anything with the attributes by the time the interceptor is run, so if you redo that, your new results will be the ones that get sent out.

You could also, if you really wanted to get optimized, attach conditions to the DataConnectors that might cause them to skip running unless it's being done inside your interceptor.

-- Scott