MFA vs. Password and Extended Flow in IDP

[Losen, Stephen C. (scl)]

Hi folks,

I am wondering about the advantages/disadvantages of the following.

For authn am using MFA with Password and Duo.  I am also using RemoteUser for client cert authn.

In my current config, RemoteUser is an "Extended flow" invoked by the Password flow.  In the login.vm view I have a "Use my Cert" button that returns "authn/RemoteUser".  So MFA does not directly invoke RemoteUser.

However, I could configure MFA to invoke Password and have Password return a custom "useCert" event in response to the "Use my Cert" button on the login.vm view.  Then in the MFA transition map, I can have MFA invoke RemoteUser.

Are there any strong reasons to prefer one method over the other? I think that the "extended flow" feature of Password predates MFA, so is MFA now the preferred, more general solution?

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640