Add Alternative Authentication Flow on the Login Page

[Cantor, Scott]

On 2/1/21, 1:01 PM, "users on behalf of Zunan Dong" <users-bounces at shibboleth.net on behalf of zunan.dong at utoronto.ca> wrote:

>    I'm trying to add a button to trigger X509 authentication flow on Duo login page. I put the following code after the Duo
> iframe.

You can't do that. You'd have to use the MFA flow, and signal a custom event back that you use in a rule to dispatch to the authn/X509 flow, but not directly. Login flows can't just invoke each other that way without more logic in the middle, and the MFA flow has the mechanics to make that work properly.

>    This button should reselect the authentication flow, authn/x509. It works well in v3.3.0.

If it did anything at all, it was by accident and would break in any number of scenarios.

>    Am I doing anything wrong? Any suggestions will be appreciated.

The approach is incorrect. The only pre-MFA documented mechanism for doing this involved the Password flow, but it was never possible to do this sort of thing out of the Duo flow (or any other one). The MFA flow replaced that earlier mechanism and is designed to run other login flows in a way that the individual flows are not.

-- Scott