IDP 3.3.1 MFA issue

[Cantor, Scott]

> I tried the solution posted by Scott Koranda in that thread. It still doesn’t
> work for me. Our primary authentication is authn/RemoteUser. I’m sure I’m
> missing something in my configuration, but I can't’ figured it out.

Your supportedPrincipal collections don't make any sense.

The Duo method is claiming to support "http://cornell.edu/mfa" but your MFA method is not consistent with that and is for some reason claiming to support IPAddress and Password contexts, probably because the default example uses those. You can't leave things defaulted, you have to adjust them all appropriately for your local choices.

The MFA flow needs to "support" all of the possible values you want to have it respond to, generally by unioning the values supported by the individual flows it's going to be orchestrating. Most of the time that's enough to get things operating correctly.

You also didn't show what your RemoteUser flow's supportedPrincipals are, but collectively it's not consistent or correct.

-- Scott