How to terminate MFA flow with an error?

[Losen, Stephen C. (scl)]

Thanks, Scott.

So the MFA transition map should return the string "authn/MyEvent"? And in conf/authn/authn-events-flow.xml should I have "authn/MyEvent" or just "MyEvent" ?  Same for conf/errors.xml ?

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, May 18, 2018 9:54 AM
To: Shib Users <users at shibboleth.net>
Subject: RE: How to terminate MFA flow with an error?

> Carefully rereading the wiki, I conclude that the MFA transition map (and my
> associated script) can ONLY return authn flow names (or null).  In particular,
> the transition map cannot cause the MFA flow to terminate with a specified
> event.

No, that's not the case (or isn't meant to be). It can signal any event. It detects events that start with "authn/" to treat them in a different way (yes, it's hacky) but the overall mechanism can handle anything.

> Efficiency concern: does the IDP run the attribute resolver multiple times or
> does it cache?  The IDP will reference attributes in at least three places: MFA
> transition, context check intercept, attribute filter.

Caching has to be configured by you. If it's not told to cache, it won't.

-- Scott

-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net