passive authn and MFA

[Cantor, Scott]

On 6/26/19, 4:02 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

> So, just to clarify, with the default behavior, the MFA flow will make sure all included flows honor passive before it
> chooses to honor it. Is that correct?

Before it runs them. With the old pre-MFA machinery in the IdP, if you had multiple login flows enabled, it would filter the set down by looking at a passive request and then throwing out any flows that didn't support passive. With the MFA flow, instead it does this filtering only at the point you tell it to run that login flow for you.

In terms of "honoring" IsPassive, all the MFA flow can do is apply it to the flows it runs, because it doesn't itself have a UI unless you build one yourself.

> And since I already have passive support enabled for password and MFA, is there any risk of enabling it for Duo?

The new version of my Duo flow does support it for non-browser use. Since it's now programmed for that, it is "safe" to use passively now because it shortcircuits itself before it will reach the iframe view. The pre-3.4 Duo flow would not be safe to toggle that flag on.

It depends what outcome you're looking for, but for a browser, the usual outcome is going to be NoPassive, which is what you're getting, so....dunno what difference you would expect but there probably won't be any.

-- Scott