Default 'sub' based C14N flow dos not run

Confirming the C14N MFA workaround like documented now on https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3013804089/OIDCRelyingPartyAuthnConfiguration#c14n4mfa works.

To confirm, I do use the MFA flow from the Password view, as I think is still the recommended way:

<entry key="authn/Password">
         <bean parent="shibboleth.authn.MFA.Transition">
           <property name="nextFlowStrategyMap">
             <map>
               <entry key="SAMLtransition" value="authn/SAML" />
               <entry key="OIDCtransition" value="authn/OIDCRelyingParty" />
               <entry key="*" value-ref="checkSecondFactor" />
…

I’ve updated the documentation on what to do if you use the RP inside the MFA flow and want the ‘sub’ claim to be used as the principal name.

Maybe for now I add that to the RP’s documentation. If you want to use the RP inside an MFA flow, you need to choose the source of the principal, and if you want it to come from the ‘sub’ claim you’ll need to add that bean reference. If you use the RP flow explicitly, it works off the inbuild one for convenience (but you could disable it if you wanted something else).

Which results in no changes to the RP. If however the use case comes back as more complicated, we can revise it.

Yeah, adding that bean reference to the shibboleth.PostLoginSubjectCanonicalizationFlows list works on my dev IdP. It is a V5 IdP, but I would not think that could make a difference.