DuoOIDC passwordless event handling question

[Scott Cantor]

> On Mar 11, 2026, at 4:17 PM, Mak, Steven via users <users at shibboleth.net> wrote:
> 
> The background to this error is that my DuoOIDC flow currently only supports refeds/mfa + TimeSyncToken authContext principals. We integrate with a fair amount of SPs that add RequestedAuthnContext of minimum PasswordProtectedTransport. In our testing when we complete a passwordless authentication our principals available in the MFA flow do not include PPT. Our IdP then returns an error response status of NoAuthnContext.

Entirely expected and what the IdP should do. You can lie if you want, but that's most definitely what you'd be doing.

I'll say it again if it has to be said, but...no SP asking for that should do so, and they have no idea why they're doing it or what they're doing. Business as usual. It's simply a bug.

That event BTW is not "mid-stream", it only gets signalled at the end because only at the very end does the idP actually know for certain that the request couldn't be accomodated, particularly because the MFA flow can do damn well anything at any time before it finally gives back control.

And when you run flows via MFA, it DOES NOT check or ensure that they're "right" or that they support what the SP asked for. We provide helpers to check that, but we don't call them.

-- Scott
> Thast