IDPv3.3 and programmatically selecting MFA based on attribute

[Cantor, Scott]

On 3/22/17, 1:43 PM, "users on behalf of Ho, PeiQuan" <users-bounces at shibboleth.net on behalf of PeiQuan.Ho at tufts.edu> wrote:

> I updated the MFA script to something like below.  But now the SSO is not functioning as expected.

Then you'll need to dig more into how it all works to debug it, and probably get more logging out. There's some fairly detailed logging of the Transition action when it decides what to do.
 
> When I log into a site requiring Duo, then SSO to a site that does not, the SSO works. But when I first login to a site that does not
> require Duo, then SSO to one that does, the IDP requires a re-login instead of just running the second factor (Duo).

If you tell the MFA flow to run authn/Password it will bypass that if it already has a result on hand from it that it can reuse. That's all I can really tell you. In most cases, the reuse of a result should be fairly automatic so you don't have to get fancy in the scripts deciding whether to run a flow or not, you can just run it and let it figure out what to do.
 
> duoValue = "urn:tufts.edu:ac:classes:PasswordProtectedTransport:duo"

That value is, FWIW, not valid. You can't make up URNs like that.

-- Scott