Enable MFA/DUO on per SP ?

[Cantor, Scott]

> How do I require MFA even when user has a valid session already?

By not doing it that way and using the approach I outlined with the scripting that is already posted in the wiki for how to properly evaluate the situation based on the SP's requirements. Brute forcing things by SP is not the proper approach.

The proper way is to evaluate things with the MFA context's isAcceptable() method to decide whether to proceed or use Duo and to ensure that the proper defaultAuthenticationMethods property is assigned with the custom Principal containing the AuthnContextClassRef that you mint locally for your organizations "standard" MFA policy.

-- Scott