Selecting Duo integration during MFA script

[Christopher Bongaarts]

I'd like to have my MFA script select between two different Duo 
integrations based on calculations and/or API calls happening as part of 
the MFA script (using the current DuoOIDC plugin on IdP 5.1.3).

I think a reasonable approach would be to stuff the result in the 
AuthenticationContext, then make a 
shibboleth.authn.DuoOIDC.DuoIntegrationStrategy bean that inspects the 
result in the AuthenticationContext and returns the appropriate Duo 
integration.

Any caveats to this approach, or suggestions on alternatives?

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%