InvalidNameIDPolicy occurs when using multi-factor authentication

[Cantor, Scott]

On 2/4/19, 7:48 AM, "users on behalf of Noriyuki TAKEI" <users-bounces at shibboleth.net on behalf of ntakei at sios.com> wrote:
> Is there any way to add an attribute to AttributeResolutionContext automatically
> when new attributes are added to attributes-resolver.xml?

That isn't what you want. You need to manipulate the MFA process to end up with a normalized principal name that matches whatever it is you need to feed into the "main" attribute resolution step later to get the results you need.

The attribute resolution that happens inside the MFA logic has nothing to do with the "main" attribute lookup. You may not even need to be doing it. Why do you think you need to resolve attributes during the MFA step? For what purpose?

-- Scott