Authentication failed with my Password/SPNEGO MFA configuration

[Cantor, Scott]

You're running SPNEGO both outside MFA and inside MFA. If nothing else, that's going to be very hard to get proper behavior from, and it won't do what you think it should, but I think the problem here is a bug. I think it's returning a previously saved off error event from the SPNEGO attempt instead of returning the result of the authn/Password flow (which in the case of reuse would just be a success). The bug comes up when you have this case of flows that constantly fail (SPNEGO) in the middle of things.

Normally the MFA rules would tend to be more like "do thing, if thing fails, abort, otherwise keep doing more things". That works. The bug affects sequences like "do thing, if thing fails, try other thing instead".

I think in this kind of case, using SPNEGO outside of the MFA rules only might be the best workaround, not to mention easier to manage. Something that's just as weird and unreliable as that probably should be off by itself perhaps.

But...if you wanted to keep it all inside MFA (and you'd need to stop enabling SPNEGO by itself to do that), the bug fix I think you would need is to insert a scripting step that handles the failure from SPNEGO and overwrites a field to clear it. Calling MultiFactorAuthenticationContext.setEvent(null) should reset things so that if Password succeeds it doesn't accidentally return the old event string. "ReselectFlow" is the thing it's returning and saving off, that's the usual "it failed but try something else" event in the system.

-- Scott