<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks Scott.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
For context, my MFA flow consists of a custom flow which renders a page that allows the user to select either SAML or LDAP login flows via a button click. I'll have a look at reuseCondition but I assume this custom flow selection page will need some way of
remembering its previous result, or the selection page will be rendered again for user interaction regardless of the subsequent lifetimes of any flows it invokes.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
John</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> 04 March 2022 16:20<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: Session Lifetime of constituent flows in MFA</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">> Is this scenario (where the authn/X509 has its own longer lifetime override) honoured when these flows are<br>
> invoked from an MFA flow?<br>
<br>
If MFA contains Password + X.509, then MFA also (usually) contains the supportedPrincipals of both. That result will satisfy any subsequent request sartisfied by one or the other, and the lifetime of the factors alone doesn't enter into it, if MFA results are
allowed to be reused. The Principals carried by the master result don't have lifetimes themselves.<br>
<br>
If MFA results are not allowed to be reused, then the MFA rules that run Password and X.509 will by default reuse existing results if they can, to optimize the UI, within their individual lifetimes, and those can vary.<br>
<br>
As a result, longer lifetimes can never work for obvious reasons (the MFA result container expires before the X.509 child could ever be reused) but shorter lifetimes can work if the MFA result resuse is blocked to allow the individual results to be interrogated
every time a request comes in.<br>
<br>
It's another use case that requires setting a false or more limited reuseCondition on the MFA flow, as with policies that will vary by user and service together, to ensure those rules get a chance to run.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>