MFA flow and individual timeouts for individual results within the MFA flow

[Scott Koranda]

On Tue, Jun 27, 2017 at 11:40 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 6/27/17, 12:18 PM, "users on behalf of Scott Koranda" <
> users-bounces at shibboleth.net on behalf of skoranda at gmail.com> wrote:
>
> > Suppose I want to enhance my mfa-authn-config.xml configuration (the
> transition map in particular) to itself manage individual
> > timeouts for the individual results within the MFA flow. Am I correct
> that my script will have access to the necessary details of
> > the individual results in order to be able to do that?
>
> The problem is that during SSO when it reuses the top-level result
> silently, it doesn't know to go through the work of unpacking all the
> individual ones and updating their last usage time. It's also somewhat
> ambiguous since it isn't clear what "last use" of a specific piece of the
> process might mean if it's reusing the "result" as a whole.
>
> What it does do, inside the MFA flow, is update the timestamp of the
> results when it unpacks them and makes them match the top level MFA
> result's timestamp, but it again just sets them all the same.
>
> > The goal is to support significantly different timeouts for the various
> flows managed by the MFA flow.
>
> That can be done as long as the intent is for them to be shorter than the
> top-level timeout rather than longer, basically.
>
>
Thanks.

Is it possible that being able to manage individual timeouts could be added
for a future release, say 4.0?

Put another way, is removing the current limitation something that is or
can be put on the roadmap?

Scott K
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170627/ef9d0de3/attachment-0001.html>