Authentication failed with my Password/SPNEGO MFA configuration

Wessel, Keith kwessel at
Wed Nov 13 18:18:06 EST 2019

Just FYI, I tested step-up authentication, and it works. The SP not requiring 2FA lets me in with password, and the SP that I then access that requires 2FA causes the IdP to go straight to a Duo prompt.

Thanks again, Scott.


-----Original Message-----
From: users <users-bounces at> On Behalf Of Cantor, Scott
Sent: Wednesday, November 13, 2019 2:20 PM
To: Shib Users <users at>
Subject: Re: Authentication failed with my Password/SPNEGO MFA configuration

On 11/13/19, 3:10 PM, "users on behalf of Wessel, Keith" <users-bounces at on behalf of kwessel at> wrote:

> Thanks, Scott. Yes, I added the dummyflow and incorporated it into my MFA flow, and it now works. I haven't confirmed
> that step-up still works as it should, but I don't see how this could have broken that. 

I don't think doing this should be a problem, but more to the point anything it breaks is probably also at risk from my code fix, so it's best to find any problems now.

> So, this works. Assuming this is a workaround, not a long-term fix, and that eventually the old way I had this will work. Is
> that correct?

Yes, I believe so.
> Thanks again for the speedy and helpful fix,

Thank you for exposing the bug.

-- Scott

For Consortium Member technical support, see
To unsubscribe from this list send an email to users-unsubscribe at

More information about the users mailing list