<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
A little background...<br>
<br>
The MCB's limit was intended to be on the number of times the user
is allowed to select an authentication method. Each authentication
method could also allow multiple tries (and, in fact, I figured that
username/password methods would try multiple times without before
returning to the MCB). We wanted to handle, for example, the case
where a user selected a method requiring a hardware token and then
found she didn't have the token in her pocket by giving her a chance
to choose another method. The limit was to keep the user from being
trapped and never returning control to the SP. (FYI, at some point
along the line, I had a discussion with Scott and decided that the
best thing would have been always to return the user to the SP,
figuring that it would then decide to prompt the user to login
again, but we had already released the MCB by then.)<br>
<br>
Now that we've got some experience with the MCB, however, it appears
that 1) many IdP administrators avoid providing choices of
authentication methods, due to the confusion it causes, and 2) IdP
administrators avoid dumping users back to an SP, as the probability
is high that the SP will not treat the user well.<br>
<br>
So, I have a couple of questions, one for Scott and one for
everyone:<br>
<br>
<ol>
<li>Scott, if the authentication method web flow returns failure,
will Shib v3 return failure to the SP or give the user another
chance?</li>
<li>David Bantz and others, are you looking for 1) multiple
attempts to select an authentication method (as the MCB does),
2) multiple attempts for select authentication methods (<i>e.g.</i>,
username/password, but not second factor), 3) multiple attempts
for all authentication methods, or something else?</li>
</ol>
<p><br>
David<br>
</p>
<br>
On 04/20/2015 12:12 PM, Cantor, Scott wrote:<br>
<blockquote cite="mid:CAABC67F-5EC2-4735-A40B-A04801BE0B89@osu.edu"
type="cite">
<pre wrap="">On 4/20/15, 6:41 PM, <a class="moz-txt-link-rfc2396E" href="mailto:db@alaska.edu">"db@alaska.edu"</a> <a class="moz-txt-link-rfc2396E" href="mailto:dabantz@alaska.edu"><dabantz@alaska.edu></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">
Agreed; that's the scenario I want to avoid. In MCB / IdP 2 I avoid by
setting high threshold for max failures. I want a config or other means
to avoid in IdP 3 as well.
</pre>
</blockquote>
<pre wrap="">
There is no notion of limiting the number of failures at all.
-- Scott
</pre>
</blockquote>
<br>
</body>
</html>