MFA flow with TOTP plugin

[Cantor, Scott]

On 7/26/21, 11:49 AM, "users on behalf of Phil Chapman" <users-bounces at shibboleth.net on behalf of phil.chapman at adept.co.uk> wrote:

> Quite how it then got through the authn.properties setting...
>    ...I don't know,

Because it wasn't the IdP selector running Password, it was your MFA script/rule.

The MFA flow only enforces a small set of things when it runs a flow. It will check things like ForceAuthn/IsPassive support for you by default (and even that's optional) but it will not enforce principal support up front because it assumes you know what you want, and it relies on enforcement afterwards to prevent errors from sneaking in. It always checks that the final result at the end is acceptable.

Because your password validator threw in exactly the value needed to subvert that check and make it pass, MFA both ran it and accepted it.

-- Scott