mfa flow w/ ECP

[Cantor, Scott]

> I believe that I need to continue using RemoteUserInternal to support ECP
> while I depend on the other RemoteUser based flows that I've created.

One way you can do that is to programmatically dispatch that in the MFA logic by examining which profile is in use in the request. There's another, but I think that's the simplest if you're trying to handle everything in one spot.

> I'm trying to migrate to the MFA flow based on a comment made in response
> to a question I posted earlier this week.

Yes, I get that.

> RemoteUserInternal cannot be the first flow tried (it screws up the principal
> name for the Unicon OIDC implementation).

I don't know why that would be true and if it were that would be a bad sign.
 
> I'm trying to figure where to "put" it in the mfa-authn-conf.xml

I don't know what your rules need to be. If you need to check what the profile is at runtime, it's a field in the ProfileRequestContext, explicitly set in that object, getProfileId(), we have various profile URIs we set in each of the cases to identify ECP vs Browser SSO vs AttributeQuery etc. A script can act on that any way it wants to.

For myself, I really didn't have to do anything, but I don't use RemoteUser. What I did was rely on the fact that I run the Password flow first, and since that works with ECP, it's all fine as long as the ECP request doesn't specify MFA required. That would break things since my Duo flow doesn't handle non-browser yet.

-- Scott