MFA with Extended Flow

[Cantor, Scott]

> I'm currently working on setting up Duo with Shibboleth using Authentication
> flows in IdP 3.4. So far it works just fine with our original password flow, with
> the exception of when I use SPNEGO, which in our setup is an Extended Flow of
> Password.

Don't do that, use MFA scripting to control all of it.

Beyond that advice, I cannot help a non-member debug anything this complex for free on list. Not remotely in scope anymore.

-- Scott