Influence MFA authentication flow based on Username alone for phased 2FA deployment

[Cantor, Scott]

In case it's not understood, you should capture the "username" based on the result of the function implemented by the net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy class

Otherwise you're going to have problems in a correctly working system. The password factor doesn't run all the time if you configure things correctly, and if it reuses an older result for SSO there is no place to get the username except the active session, which that function will dive into automatically.

-- Scott