MFA flow and individual timeouts for individual results within the MFA flow

[Cantor, Scott]

On 6/27/17, 12:18 PM, "users on behalf of Scott Koranda" <users-bounces at shibboleth.net on behalf of skoranda at gmail.com> wrote:

> Suppose I want to enhance my mfa-authn-config.xml configuration (the transition map in particular) to itself manage individual
> timeouts for the individual results within the MFA flow. Am I correct that my script will have access to the necessary details of
> the individual results in order to be able to do that?

The problem is that during SSO when it reuses the top-level result silently, it doesn't know to go through the work of unpacking all the individual ones and updating their last usage time. It's also somewhat ambiguous since it isn't clear what "last use" of a specific piece of the process might mean if it's reusing the "result" as a whole.

What it does do, inside the MFA flow, is update the timestamp of the results when it unpacks them and makes them match the top level MFA result's timestamp, but it again just sets them all the same.

> The goal is to support significantly different timeouts for the various flows managed by the MFA flow.

That can be done as long as the intent is for them to be shorter than the top-level timeout rather than longer, basically.

-- Scott