mfa flow w/ ECP

[Liam Hoekenga]

> If you mean the MFA rule and scripts, you have to control exactly what
login flows run and when and why.
> There is no fall through between any of them unless you do it, it just
does what you tell it to do.

I believe that I need to continue using RemoteUserInternal to support ECP
while I depend on the other RemoteUser based flows that I've created.

I'm trying to migrate to the MFA flow based on a comment made in response
to a question I posted earlier this week.

RemoteUserInternal cannot be the first flow tried (it screws up the
principal name for the Unicon OIDC implementation).
I'm trying to figure where to "put" it in the mfa-authn-conf.xml

Liam


On Thu, Nov 9, 2017 at 4:21 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > I'm trying to figure out what I'd use in the conditional code to fall
> through to
> > RemoteUserInternal.  Something related to nonBrowserSupported?
>
> I don't know that ECP would even handle what you're doing with MFA, but
> which conditional code are you asking about?
>
> If you mean the MFA rule and scripts, you have to control exactly what
> login flows run and when and why. There is no fall through between any of
> them unless you do it, it just does what you tell it to do.
>
> -- Scott
>
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171109/f390e2dd/attachment.html>