Best way to enable MFA globally?

[Cantor, Scott]

On 1/29/18, 4:46 PM, "users on behalf of McKean, Brandon Scott - mckeanbs" <users-bounces at shibboleth.net on behalf of mckeanbs at jmu.edu> wrote:

> Though I suspect it could also be done in mfa-authn-config.xml by always setting nextFlow to "authn/Duo".

If you want everything covered and want the IdP to auto-reject requests for, e.g. X.509 authentication or other unknown or unsupported authentication contexts, then I would just implement the MFA flow to do what you want, enumerate the context classes appropriately, and leave it as the only login flow enabled. There's not really anything else to do. If an SP requests something goofy it will fail, but if it requests something supported, it will do the same thing all the time.

-- Scott