MFA fails canonicalization of 2nd factor when re-using existing session

[Cantor, Scott]

I think there's a logging bug that's failing to note that the problem is there are two UsernamePrincipals in the final pile of merged results, one from the Password flow and one from SPNEGO. Simple c14n can't do that, it only runs when there's a single one (it doesn't actually look and see whether they're the same, and in most cases they're not because SPNEGO will populate its copy with the Kerberos principal name).

So anyway, that's probably the issue. If you let it just merge them all together and then try and apply "simple" that's not going to fly. You need a custom merging function to produce the MFA results at the end or you need a custom c14n solution that knows how to deal with the merged results.

I'd also be curious what happens if you bypass Password and go straight to SPNEGO + Duo. Unless you do something about it, the Kerberos principal names should be getting passed up to Duo as the username, and I can't imagine that's what you'd want either. You probably could apply a regex via simple c14n to transform those into something though.

I'm going to do a bit of poking at the logging and see if I can get a bit more out of it for the next patch, it should record the reason "simple" couldn't apply, not just that it couldn't.

-- Scott