MFA transition map with SPNEGO and ECP

[Mak, Steve]

I was trying to get MFA setup with 'Try SPNEGO first, then fail to Password', but ECP seems to break this because the IdP says that ECP is RequestUnsupported for SPNEGO.

I thought I could simply do this:

mfa-authn-config.xml snippet:

        <!-- First rule runs the SPNEGO login flow. -->
        <entry key="">
            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/SPNEGO"/>
        </entry>

        <!--
        Second rule proceeds to checkSecondFactor script is successful, authn/Password if not.
        -->
        <entry key="authn/SPNEGO">
            <bean parent="shibboleth.authn.MFA.Transition">
                <property name="nextFlowStrategyMap">
                    <map>
                        <entry key="RequestUnsupported" value="authn/Password"/>
                        <entry key="ReselectFlow" value="authn/Password"/>
                        <entry key="proceed" value-ref="checkSecondFactor"/>
                    </map>
                </property>
            </bean>
        </entry>

general-authn.xml snippet:

        <bean id="authn/SPNEGO" parent="shibboleth.AuthenticationFlow"
                p:nonBrowserSupported="false">


But that doesn't work.  I've tried toggling nonBrowserSupported to true but that doesn't seem like the correct answer, and it doesn't actually work.

Does anyone know how to make this work?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190620/7b62d938/attachment.html>