SPNEGO as first factor in MFA

[Rabe, Jens]

Hi, 

we want to use SPNEGO as first factor in MFA. Every thing is setup an working but there is one thing that drives me crazy and thats forceAuthn.

My mfa-auth looks like:

    <util:map id="shibboleth.authn.MFA.TransitionMap">
        <entry key="">
            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/SPNEGO" />
        </entry>

        <entry key="authn/SPNEGO">
            <bean parent="shibboleth.authn.MFA.Transition">
                <property name="nextFlowStrategyMap">
                     <map>
                        <entry key="AuthenticationException" value="authn/Password" />
                        <entry key="proceed" value-ref="checkSecondFactor" />
                    </map>
                </property>
            </bean>
        </entry>

        <entry key="authn/Password">
            <bean parent="shibboleth.authn.MFA.Transition">
                <property name="nextFlowStrategyMap">
                    <map>
                        <entry key="proceed" value-ref="checkSecondFactor" />
                    </map>
                </property>
            </bean>
        </entry>
    </util:map>

But I don't know how to decide if forceAuthn is active to jump to Password?

Maybe with an scripted firstFactor or let the validator filter the transition (https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505534/MultiFactorAuthnConfiguration#Custom-Events).

Thanks in advance
Jens