IDPv3.3 and programmatically selecting MFA based on attribute

[Cantor, Scott]

> On 3.2.0, we use
> 	idp.authn.resolveAttribute = eduPersonAssurance
> Along with the unicon/Duo libraries to determine MFA flow.  I guess you're
> saying that's deprecated now.

The MFA flow is the *whole* thing, both factors. It needs to do the Password step and the Duo step and it needs to control when and whether they happen (to a point). That's the only flow you enable (unless you're doing something unrelated alongside like X.509 or something of that nature, and even then it's usually going to be best handled from within the MFA layer).

The example provided with the software illustrates how to resolve an attribute inside the MFA sequence and use it to decide what to do, to provide a starting point for development of the local logic required. Unlike the original feature, which was brittle and only usable in a tiny set of scenarios, the MFA rules can do anything you want them to do.

> As far as using an attribute within the MFA transition rules/scripts, is it
> possible to retrieve a value from MySQL, similar to how you can do it in the
> attribute-resolver.xml with a DataConnector?

You can write Java or Javascript code to do anything, but why would you? The resolver will do it for you and invoking the resolver is trivial now, which is what the example demonstrates.

-- Scott