Best practice MFA IdP3.3.1

[O'Dowd, Josh]

I have a scenario where I may need to prompt a Password/LDAP-authenticated user, based on some attribute resolver logic, and use that selection as a factor in the attribute resolve phase.  I think the best way to handle the first piece, is to use MFA with a script that would decide "to prompt or not to prompt".  If user is prompted, I am not sure of the best way to get the resulting selection event to the attribute resolver.  Should I add a principal to the Subject, somehow, or maybe just a context variable?

Thanks for any advice you can give.

Josh O'Dowd
Software Systems Engineer / Identity Access Management
Central IT, University of Montana

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170911/452d4233/attachment-0001.html>