Authentication failed with my Password/SPNEGO MFA configuration

[Cantor, Scott]

On 11/13/19, 12:41 PM, "users on behalf of Losen, Stephen C (scl)" <users-bounces at shibboleth.net on behalf of scl at virginia.edu> wrote:

> I don't know if this applies or not, but we are using a button in login.vm to let the user select a x509 client certificate
> login instead of username/password. The client cert stuff is handled by our F5 load balancer and we are using
> RemoteUser to fetch the username from a HTTP header passed by the F5. But that's not really the point here. The
> button on our login.vm causes the Password flow to return with a custom event (UseCert). In our MFA config, if
> Password returns this event, then MFA launches RemoteUser. 

That's exactly the sort of thing I was referring to. The old extended flow thing was a rudimentary way of doing that without the open-endedness. I will probably think about redoing the templates and some of the SPNEGO examples around this at some point.

> If Password returns "proceed" or RemoteUser returns "proceed" then MFA launches Duo. So the user sees the login
> page and can either enter username/password or click the "Use Cert" button.  If either succeeds, then they go to Duo.
> Perhaps you could have a similar button for SPNEGO, which I know nothing about, so this approach may not work. By
> the way, MFA is the only flow enabled in our idp.properties.

It's essentially the same, yes.

The problem with the bug is the notion of "failure, then success", where as "success, then success or failure" works ok.

-- Scott