forceAuthn, MFA, RemoteUser

[Christopher Bongaarts]

On 10/28/2024 9:45 AM, Cantor, Scott via users wrote:
> The MFA flow already supports ForceAuthn. It's your external mechanism that doesn't.
>
> Nor is building an External hook that supports authn "writing a new flow", they're fundamentally different approaches. External is about not having to build a webflow.
>
> External is a login flow that calls out to a servlet/JSP. Your job is building that, only. RemoteUser is just External with a built-in servlet.

Having done both, I concur with Scott - building an External method is 
less work than writing a new authn flow.  You could even use the 
RemoteUser servlet as a base to work from.

The biggest issue is, assuming you want to force reauthentication on the 
first factor, how to signal it.  Depending on the first factor, it might 
be a matter of adding parameters to a redirect, or clearing a cookie for 
the first factor before redirecting to the servlet.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%