IDPv3.3 and programmatically selecting MFA based on attribute

[Ho, PeiQuan]

On 3.2.0, we use
	idp.authn.resolveAttribute = eduPersonAssurance
Along with the unicon/Duo libraries to determine MFA flow.  I guess you're saying that's deprecated now.

As far as using an attribute within the MFA transition rules/scripts, is it possible to retrieve a value from MySQL, similar to how you can do it in the attribute-resolver.xml with a DataConnector?  Would it be possible to provide sample code on how that's done?

Thanks,
-PQ

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, March 23, 2017 11:22 AM
To: Shib Users <users at shibboleth.net>
Subject: RE: IDPv3.3 and programmatically selecting MFA based on attribute

> When I login to a non-Duo SP, then login to a Duo SP, I get prompted 
> again for login instead of just the secondFactor.  Here's what I'm seeing in the logs.

You're using at least one feature that can't really be used with the MFA flow, the filtering flows by attribute thing. Don't use that (it's deprecated anyway). I would guess that's ultimately the cause of your problem, but I won't spend any time on it until that's gone and the picture is clearer.

If you want to apply logic based on an attribute, that needs to be inside your MFA transition rules and scripts.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net