Session Lifetime of constituent flows in MFA

[John Watt]

Thanks Scott.

For context, my MFA flow consists of a custom flow which renders a page that allows the user to select either SAML or LDAP login flows via a button click. I'll have a look at reuseCondition but I assume this custom flow selection page will need some way of remembering its previous result, or the selection page will be rendered again for user interaction regardless of the subsequent lifetimes of any flows it invokes.

Thanks,
John
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: 04 March 2022 16:20
To: Shib Users <users at shibboleth.net>
Subject: Re: Session Lifetime of constituent flows in MFA

>    Is this scenario (where the authn/X509 has its own longer lifetime override) honoured when these flows are
> invoked from an MFA flow?

If MFA contains Password + X.509, then MFA also (usually) contains the supportedPrincipals of both. That result will satisfy any subsequent request sartisfied by one or the other, and the lifetime of the factors alone doesn't enter into it, if MFA results are allowed to be reused. The Principals carried by the master result don't have lifetimes themselves.

If MFA results are not allowed to be reused, then the MFA rules that run Password and X.509 will by default reuse existing results if they can, to optimize the UI, within their individual lifetimes, and those can vary.

As a result, longer lifetimes can never work for obvious reasons (the MFA result container expires before the X.509 child could ever be reused) but shorter lifetimes can work if the MFA result resuse is blocked to allow the individual results to be interrogated every time a request comes in.

It's another use case that requires setting a false or more limited reuseCondition on the MFA flow, as with policies that will vary by user and service together, to ensure those rules get a chance to run.

-- Scott


--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220304/3fadb6d7/attachment.htm>