Duo in Shib 3.3

[Cantor, Scott]

> That's one of the big reasons, yes. And because the system gets tied up in knots very fast if you try and enable both 
> Password and MFA at the same time and rely on that sort of trick to get the right thing to run. Lots of failure modes will > do things you don't expect and it will not end up broken in the end, but not in ways you're going to understand or notice
> just doing simple testing.

That should say "will end up broken..." obviously.

The primary problem with it is the fall-through nature of the system when multiple login flows are enabled, it will tend to just try whatever's next in the list. The MFA flow is generally meant to be enabled by itself and used to direct which actual methods run rather than enabled together with others; it's a replacement for what the IdP does internally to choose methods rather than a supplement.

That in turn is what makes it problematic to do the selection process the way you're describing.

-- Scott