ECP on an idp configured for MFA

[Paul B. Henson]

> From: Cantor, Scott
> Sent: Tuesday, February 19, 2019 6:38 PM
> 
> You can, just inherit from beans containing the truly default behavior. There's
> also the metadata-driven way of doing all of this to avoid having multiple
> overrides that cross behavior.

Right, I am doing that for overriding a setting from the default relying party:

	<bean parent="SAML2.SSO.custom" ...

However, I don't want to change anything about ECP in the override, I just want it to act exactly like the default, but I still need to include:

	<ref bean="SAML2.ECP" />

in the override or it doesn't work. Perhaps the metadata method avoids this redundancy, I haven't looked into it in much detail.

> I thought it was explicit that you have to have one with Auth API support but
> it wasn't. That works for both. WebSDK only does not.

Ah, ok; I see you updated the wiki, thanks. That edit makes the behavior clear.

> It documents all the HTTP headers supported that provide control over the
> behavior and lists the default header names, all of which are arbitrary and
> changeable. It does not work well for tokens, that's just not practical unless
> the client deals with it, but it's functionally possible.

Oh, I didn't under the documentation initially; the headers are supposed to be provided by the ECP client to the idp, now it makes sense.

Thanks much for spending the time to lead a horse to water :).