IDPv3.3 and programmatically selecting MFA based on attribute

[Cantor, Scott]

> I actually was not able to upgrade our v3.2.0 instance to v3.3 due to conflicts
> with the previous unicon/duo setup.

I am aware of no such conflicts, I was speaking of the conflicts between the older features and newer ones only. If I knew of a conflict, we'd have fixed it. Nobody has reported anything I can actionably follow up on.
 
> In any case, currently it's setup with these settings for idp.properties

The latter two don't have defaults, so commenting them out effectively just turns them off, which is the desired state.

> idp.authn.flows = MFA
> #idp.authn.flows.initial = Password
> #idp.authn.resolveAttribute = eduPersonAssurance

> One thing I noticed is the first login to an SP, the MFA runs the first factor
> (Password), then check the second factor (Duo) as shown in Log 1 below.
> But then, when I SSO to another SP, it seems like the MFA flows are not
> actually run at all, but just checks what's in the cache.  This is shown in Log 2
> below.

Yes, because the IdP is doing the checking, and that's independent of the MFA feature. The ability to prevent that was added for a future release, and Scott Koranda proposed and I believe documented a workaround for cases now where it's a requirement that the MFA logic always run.
 
>  Also, turning off the idp.authn.resolveAttribute setting, the SP gives
> me an error: " The gap between now and the time you logged into your
> identity provider exceeds the limit."

You *did* turn it off, the above shows it commented out.

That SP error has nothing to do with any of this, it's a message from a Shibboleth SP that's enforcing a limit on the time since the Authentication timestamp in the assertion, normally as a means of making sure the ForceAuthn option was honored. There is no connection between that and anything else that's been discussed, apart from the fact that SSO will inherently cause an SP checking that to see a problem.

If the SP were requesting ForceAuthn, the IdP would honor it, and you would not see reuse of any results.

-- Scott