Different inactivityTimeout in a MFA environment

[Cantor, Scott]

> By the way, some clever people suggested me that, just for
> this very limited purpose (limiting the number of times the
> TOTP verification view shows up during a session), it is
> possibile to just set a custom cookie in the totp.vm view and
> have its presence verified in the nextFlowStrategy bean
> leading to TOTP,

That's more or less like implementing Duo's Remember Me option, you just have to take care, make sure the cookie is reasonable, not forgeable, etc. That's not trivial. You'd likely want to reuse the IdP's CookieManager and DataSealer beans for that.

Also, it'sa bit different to bypass use of the flow, at which point the IdP wouldn't build that result into its final MFA result, nor any of the Principals. That's probably "good", as it's not a misrepresentation like running a flow and having it silently act as though it did something would (cough, Duo), but it would also mean that the result would probably not satisfy multi-factor in terms of how it portrayed the outcome.

If what you want is just to conditionally apply a longer timeout on the MFA result, I'd probably be inclined to do the work to script that, and it's probably less work in the aggregate than a cookie would be and much less prone to mistakes that would be harmful.

If you file it, I think we can come up with a simpler scheme to "surface" a timeout value to apply that we'd store in the AuthenticationResult (so it would override the default from the flow definition). Then it could just be signaled from the MFA rules out to the final result build step.

-- Scott