Multiple DuoOIDC -- Integration-Specific Principal Sets

[Cantor, Scott]

> Thanks very much. . . On the chance it might be something
> obvious, here is what I am seeing. (otherwise, I'll open a
> ticket) 

I contacted you offline about support access. You could put something in Jira itself, but that's not really what I meant, I don't want you to have to expose logs and such publically if you don't want to.

> The IDP first says the result from the DefaultDuo is not
> usable:"Active result for flow authn/MFA not usable,
> ignoring." 

Right, that's what you'd want.

> But then it says it's reusing it:
>"Reusing active result for flow authn/DuoOIDC"

That means the result produced by the original integration included the "special" Principal context class.

That would mean either you included it in the "default" integration's supportedPrincipals, or more likely I suspect that you don't have that auto-attach behavior turned off, so since your properties file likely includes both context classes in the DuoOIDC flow's supported set, it's auto-adding them all.

I'll check into when we fixed the bug there, but meanwhile, make sure you put that special bean in my REFEDS example in the duo-oidc-authn-config.xml file (maybe you put it in global.xml?)

-- Scott