<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
It is helpful thank you. I'll need to track what's going on, but to do that I need to dive a little deeper than I probably should at this point. My username is being added as a second principal in the list later on in the process...<br>
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
I won't take more of your time troubleshooting, I think I generally have what I need available to me in that regard.
<br>
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
I will say, the idea of gating the MFA process at the IDP in any way would generally be frowned upon, with respect to your referencing the IDP 'lying'. You don't personally like the implementation in this [1] document (which I had to dig out of my history)?
I understand you don't want to get into the weeds... Feel free to end the thread here if you think it's going in an unsupported direction. I'm just curious from a high level standpoint.<br>
<br>
<br>
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
[1]<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration</a><br>
<br>
</div>
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
<span id="OutlookSignature">
<div dir="auto" style="direction: ltr; margin: 0; padding: 0; font-family: sans-serif; font-size: 11pt; color: black; ">
Get <a href="https://aka.ms/ghei36">Outlook for Android</a></div>
</span><br>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> Wednesday, March 18, 2020 5:50:20 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: c14n attribute sourced subject, multiple principals</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">[EXTERNAL EMAIL]<br>
<br>
> Re: my other point... I added a log to the PrincipalNameLookupStrategy, and<br>
<br>
It might be illuminating/new information that every login flow individually runs the c14n step, so possibly what you're seeing is just the multiple runs of whatever it is that you configured from the different flows/factors running. Or possibly that's not new
information and not helpful, but just in case...<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>