Best practice MFA IdP3.3.1

[Cantor, Scott]

On 9/11/17, 5:15 PM, "users on behalf of O'Dowd, Josh" <users-bounces at shibboleth.net on behalf of Josh.O'Dowd at mso.umt.edu> wrote:

> I have a scenario where I may need to prompt a Password/LDAP-authenticated user, based on some attribute resolver logic, and
> use that selection as a factor in the attribute resolve phase.  I think the best way to handle the first piece,
> is to use MFA with a script that would decide “to prompt or not to prompt”.  If user is prompted, I am not sure of the best way to
> get the resulting selection event to the attribute resolver.  Should I add a principal to the Subject, somehow, or maybe just
> a context variable?

I don't know what you mean by context variable, but a Principal placeholder of some kind is probably fine. It depends whether you need it preserved for subsequent logins I suppose. Kind of has to end up in the Subject in that case, but you'll have to mess around with registering your Principal class for serialization if you need that to work. There's a little bit on that in the documentation (Extending the Serialization of Results).

If you don't need it preserved then there are a lot of different ways it could be done. I know people are doing things with flow variables but I tend to avoid it just to keep things relatively divorced from Spring.

No matter what, it won't handle queries, if that matters.

-- Scott