IDPv3.3 and programmatically selecting MFA based on attribute

[Cantor, Scott]

> I thought that's what I was trying to do.

The old feature you're using is not for use with the MFA feature, it's an old, broken way of trying to do a tiny subset of the things the MFA feature is designed to do, and it can't be sensibly mixed with it.

If you're also using the initial-authn feature, which tends to go hand in hand with that attribute property, then you MUST get rid of that. That will also destroy any chance of getting this to work right. You didn't say you were using it, and I didn't ask, but you really can't use one without the other most of the time.

 > * I set idp.authn.flows = MFA

The way the filtering "feature/bug" works is by filtering which flows are available for use or reuse. If you only have a single login flow enabled to begin with, then it can break the whole system by filtering out the MFA flow and rendering it unusable. At which point the IdP will give up and say there are no flows it can try and fail the login. The feature simply has no role anymore.

> * In authn/mfa-authn-config.xml, I want to decide whether to do Duo based
> on attribute eduPersonAssurance.  That attribute is merely a string.  If the
> value is " urn:tufts.edu:ac:classes:PasswordProtectedTransport:duo", I set
> the nextFlow as "authn/Duo".

You're enabling the property because you want the IdP to resolve the attribute, but that property doesn't just do that one thing, it also applies a filtering step that will break. You have to turn it off and resolve the attribute from within the MFA flow itself.

Also, you often can't really use that property at all unless you also have the initial-authn feature in use and that is hopeless.

You have to understand that everything you did with the authentication layer other than the login form and the specific settings related to how the password is handled are defunct. Everything else you configured and used has to be undone.
 
> This seems to be working except when the SSO scenario I had mentioned.

It cannot be working, so I don't know what to tell you, I just know from the log that there's something deeply wrong with it.
 
-- Scott