users unexpectedly through different Authn handler

[Cantor, Scott]

On 11/8/17, 4:44 PM, "users on behalf of Liam Hoekenga" <users-bounces at shibboleth.net on behalf of liamr at umich.edu> wrote:

> We're using two authn handlers based on RemoteUser - RemoteUserPlus (which supports forceAuthn and isPassive), and
> RemoteUserToken (which supports MFA).

Well, neither should be "enabled" in the IdP top-level sense, only the MFA flow should be. It should dispatch to the flows you want run, when you want them to run, and so at that point...

> Is there any way to tell why it's deciding to send them through that handler?

...the intended answer becomes "because you told it to". Or there may just be a mistake in the rules you configured for what it should be doing.

Without knowing what exception was happening I can only say that exceptions would be getting bubbled back out and ending the login attempt entirely, not in general cascading from one to another flow. It just doesn't do that. There are very specific error cases that get remapped by the system into a "reselect" that causes it to try and select a different login flow to try. An exception wouldn't be among those cases unless it were explicitly configured to do that.

Anyway, as long as idp.authn.flows is set to MFA alone, any unintentional behavior should be a result of the rules in use and ought to be easy enough to fix in most cases.

-- Scott