Default Authentication Flow + MFA

[Cantor, Scott]

On 3/29/17, 4:43 PM, "users on behalf of Klingenstein, Nate" <users-bounces at shibboleth.net on behalf of nklingenstein at calstate.edu> wrote:

> Users need to be able to authenticate through a Password page.  This is not the default.
>
> Users also need to be able to authenticate through MFA, which involves RemoteUser + Duo.  This should be the default.

That's insane, but you're better off explicitly setting a defaultAuthenticationMethod value in every case to trigger the second, and I guess you'll have to define something that has to be requested or set in defaultAuthenticationMethod to trigger the first in the special cases.

Of course the supportedPrincipal collections had better not overlap or none of this is going to work well.

In short, don't hope it picks the right thing, make sure every request gets associated with explicit criteria for deciding what to run so it behaves predictably.

> I find:
> 3)  Is specific custom Principal support requested or indicated as a default?

i.e., do what I say above and make sure the answer is yes.

> 1)  What does "select a potential flow and execute it" mean?  Do I have to get into the weight map thingy?

No, and it doesn't matter if you do what I suggested, but it means it picks a flow that's enabled and tries it. Nominally in the order they're laid out in the general-authn list.

> 2)  Is it smartest to try to script all of this into a single MFA blob, or leave the Password flow alone?

As long as you do what I suggested, leave Password alone as one method and script RemoteUser + Duo inside MFA for the other. As long as they're entirely independent it's just like doing two separate set ups that are fairly simple on their own.

-- Scott