MFA fails canonicalization of 2nd factor when re-using existing session

[Cantor, Scott]

On 4/14/21, 6:09 PM, "users on behalf of Grant Byers" <users-bounces at shibboleth.net on behalf of Grant.Byers at aarnet.edu.au> wrote:

>    Thanks Scott. That makes sense.

It does and it doesn't. I'm debating whether to extend the check for applicability to walk the whole list and see if the usernames all match. I didn't do that originally because it was just easier to let it check the count and it's not that common to have more than one.

But for "ease of deployment" it's a lot simpler to let it handle a case like this (assuming the usernames match) and not break. I think it's a premature optimization that isn't really saving much time (comparing two strings is not exactly onerous).

Doesn't help you for the moment but I think I'll probably fix it for 4.1.1. If you wanted to patch it yourself in the meantime, you can follow IDP-1797

-- Scott