Add Alternative Authentication Flow on the Login Page

[Zunan Dong]

Thanks Scott.

Should I create a view-centric flow to present a web page to my users and ask them to select which MFA they want to use (Duo/X509)? And each option will signal an event at backend which will trigger the corresponding login flow. Is this the correct approach?


Zunan Dong

Authentication Systems Specialist

Information Security

Information Technology Service

University of Toronto

Email: zunan.dong at utoronto.ca


________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: Monday, 01 February 2021 17:19
To: Shib Users <users at shibboleth.net>
Subject: Re: Add Alternative Authentication Flow on the Login Page

EXTERNAL EMAIL:

On 2/1/21, 1:01 PM, "users on behalf of Zunan Dong" <users-bounces at shibboleth.net on behalf of zunan.dong at utoronto.ca> wrote:

>    I'm trying to add a button to trigger X509 authentication flow on Duo login page. I put the following code after the Duo
> iframe.

You can't do that. You'd have to use the MFA flow, and signal a custom event back that you use in a rule to dispatch to the authn/X509 flow, but not directly. Login flows can't just invoke each other that way without more logic in the middle, and the MFA flow has the mechanics to make that work properly.

>    This button should reselect the authentication flow, authn/x509. It works well in v3.3.0.

If it did anything at all, it was by accident and would break in any number of scenarios.

>    Am I doing anything wrong? Any suggestions will be appreciated.

The approach is incorrect. The only pre-MFA documented mechanism for doing this involved the Password flow, but it was never possible to do this sort of thing out of the Duo flow (or any other one). The MFA flow replaced that earlier mechanism and is designed to run other login flows in a way that the individual flows are not.

-- Scott


--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210202/9a5fc393/attachment.htm>