<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks Scott. </div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Should I create a view-centric flow to present a web page to my users and ask them to select which MFA they want to use (Duo/X509)? And each option will signal an event at backend which will trigger the corresponding login flow. Is this the correct approach?</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Helvetica,sans-serif">
<p style="margin-top: 0px; margin-bottom: 0px;margin-top:0; margin-bottom:0"><span id="ms-rterangepaste-start"></span></p>
<pre class="moz-signature" cols="72">Zunan Dong</pre>
<pre class="moz-signature" cols="72">Authentication Systems Specialist</pre>
<pre class="moz-signature" cols="72">Information Security
Information Technology Service
University of Toronto
Email: zunan.dong@utoronto.ca</pre>
<span id="ms-rterangepaste-end"></span><br>
<p style="margin-top: 0px; margin-bottom: 0px;"></p>
</div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> Monday, 01 February 2021 17:19<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: Add Alternative Authentication Flow on the Login Page</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">EXTERNAL EMAIL:<br>
<br>
On 2/1/21, 1:01 PM, "users on behalf of Zunan Dong" <users-bounces@shibboleth.net on behalf of zunan.dong@utoronto.ca> wrote:<br>
<br>
> I'm trying to add a button to trigger X509 authentication flow on Duo login page. I put the following code after the Duo<br>
> iframe.<br>
<br>
You can't do that. You'd have to use the MFA flow, and signal a custom event back that you use in a rule to dispatch to the authn/X509 flow, but not directly. Login flows can't just invoke each other that way without more logic in the middle, and the MFA flow
has the mechanics to make that work properly.<br>
<br>
> This button should reselect the authentication flow, authn/x509. It works well in v3.3.0.<br>
<br>
If it did anything at all, it was by accident and would break in any number of scenarios.<br>
<br>
> Am I doing anything wrong? Any suggestions will be appreciated.<br>
<br>
The approach is incorrect. The only pre-MFA documented mechanism for doing this involved the Password flow, but it was never possible to do this sort of thing out of the Duo flow (or any other one). The MFA flow replaced that earlier mechanism and is designed
to run other login flows in a way that the individual flows are not.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>