Selecting DuoOIDC 'config' based on user attribute in LDAP

[Cantor, Scott]

> This is what I was calling cloning the authn provider. Each was its own' 
> authn flow at that point.

Yes. That's unsupported and will absolutely break upgrades. It is the cardinal sin. You cannot, under any circumstances, copy our flows, because they contain implementation classes and those change at any time.

> In the MFA handler the custom object is set as part of the customobject-ref
> from MFA, but the customobject-ref needs to be reserved for the'
> integration map to adjust the duo configs (I believe).

You can add a layer of indirection. Map of custom objects, one of which is  a map of integrations.

> Is there anything you could point us to in terms of documentation that
> would help? Is there a way to pass the attribute value from the MFA to
> DuoOIDC?

A few ways. There's a ScratchContext class in OpenSAML that just wraps a map and can be added to the context tree by the MFA logic and read back later, so that's one way.

-- Scott