Best place in IdP SSO login flow to allow users to choose issuer of assertion

[Daniel Lutz]

Cantor, Scott schrieb am 06.06.17 um 17:03:
> 3.3 doesn't have a built-in way of bypassing SSO. The workaround of using ordered AuthnContextClassRefs in a request
> really just works for second-factor cases. I already added a condition property to control SSO to all the login flow
> descriptors, so it's fixed in 3.4 and you can coordinate everything through the MFA rules on every request but that
> doesn't help you now.
Thanks for the information.

> If the point is that you need to know the identity of the issuer during resolution, then you can simply let it run, 
> run a post-authn interceptor, and have that interceptor clear the resolved AttributeContext state and re-run the 
> attribute resolution and filtering steps after the user selects the issuer. The system hasn't done anything with the 
> attributes by the time the interceptor is run, so if you redo that, your new results will be the ones that get sent
> out.
We will eventually do it this way, i.e. letting the post-authn interceptor re-resolve the final attributes.
Thanks for the detailed description.

> You could also, if you really wanted to get optimized, attach conditions to the DataConnectors that might cause them
> to skip running unless it's being done inside your interceptor.
Yes, I already thought of doing something like this.

Thanks.


Daniel