SPNEGO as first factor in MFA

[Cantor, Scott]

> But I don't know how to decide if forceAuthn is active to
> jump to Password?

If ForceAuthn is requested, there's a flag set in the AuthenticationContext you can check to determine that and adjjust selected flows if that's what you want to do.

Setting the SPNEGO flow to "support" it is not in general a correct thing to do unless something prevents it from actually being used (alone) in a ForceAuthn scenaio, and keeping the flag set to false is mainly what prevents that.

If you want to use it as one of a set of factors and you know that at least one of them will be run from scratch, then it might be reasonable to do.

-- Scott