<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><span class="gmail-m_8276405838335803229m_8260270469110691902gmail-"><div>Are you just trying to trigger a flow if one of the contexts is present?<br></div></span></div></div></div></blockquote><div><br></div><div>Yes.</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">IOW, you do Password, which should only get you Password or PPT, depending on your configuration.</div></div></div></blockquote><div><br></div><div>In our pre-MFA flow configuration, we had an authentication flow that invoked Duo (via external auth) if any of these contexts was requested:</div><div>    urn:oasis:names:tc:SAML:2.0:ac<wbr>:classes:TimeSyncToken</div><div>    <a href="http://id.incommon.org/assurance/mfa" target="_blank">http://id.incommon.org/assuran<wbr>ce/mfa</a></div><div>    <a href="https://refeds.org/profile/mfa" target="_blank">https://refeds.org/profile/mfa</a></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">Is your required logic amenable to this:</div><div class="gmail_quote"><br></div><div class="gmail_quote">mfaCtx = authCtx.getSubcontext("net.shi<wbr>bboleth.idp.authn.context.Mult<wbr>iFactorAuthenticationContext")<wbr>;<br></div><div class="gmail_quote">if (mfaCtx.isAcceptable()) { return null; }  // current principals suffice</div><div class="gmail_quote">else { return nextFlow; } // run second factor</div></div></div></blockquote><div> <br></div><div><div>I don't yet need to trigger MFA based on a directory attribute, but will after we migrate from our legacy SSO to Shib as the primary authenticator.</div></div><div><br></div><div>What I'm starting with is a combination of Jim Fox's suggestion in <a href="http://shibboleth.net/pipermail/users/2016-December/033096.html" target="_blank">http://shibboleth.net/piper<wbr>mail/users/2016-December/03309<wbr>6.html</a>...</div><div><br></div><div><div>      authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");</div><div>      rpCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.RequestedPrincipalContext");</div><div>      if (rpCtx != null) {</div><div>          rps = rpCtx.getRequestedPrincipals();</div><div>          tkp = new AuthnContextClassRefPrincipal("urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken");</div><div>          if (rpCtx.getRequestedPrincipals().contains(tkp)) {</div><div>            logger.debug("RP requested token login");</div><div>          }</div><div>      }</div></div><div><br></div><div>and the wiki example (<a href="https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration#MultiFactorAuthnConfiguration-ProgrammaticallySelectingFlows" target="_blank">https://wiki.shibboleth.net/c<wbr>onfluence/display/IDP30/MultiF<wbr>actorAuthnConfiguration#MultiF<wbr>actorAuthnConfiguration-Progra<wbr>mmaticallySelectingFlows</a>).</div><div><br></div><div>How does isAcceptable() decide isAcceptable?  Is it the weight map in general-authn.xml?</div><div> </div><div>Liam</div></div></div></div>