Terminate session if user does not accept terms&conditions

[Cantor, Scott]

On 6/11/21, 8:09 AM, "users on behalf of Oluf Færø" <users-bounces at shibboleth.net on behalf of ofa at klintra.fo> wrote:

>    An alternative path for me could be to implement a “ToU” authentication step in a MFA authentication
> configuration. The “ToU” could be a simple check-box which must be selected.

You could, yes, but the challenge in all cases is the storage. A cookie of course is simple, but is per-device and subject to frequent reset. Anything else is much more work.

> The current authentication is an external configuration. Is it possible to configure the MFA to use a sequence to
> two external authentication steps ?

This isn't two external authentication steps, you're not talking about authentication. You cannot make this a login flow, that will just break the system. This is just a custom flow to do something in particular before authentication"commits" and would be captured and finalized.

The MFA transition rules can call regular flows, it distinguishes them by the authn/ prefix being part of the flow name or not. The non-authn case isn't well-tested however.

-- Scott