As a caution, if you add a custom flow or make use of one of the technology-independent flows in a way that is not password-based, don't forget to override the corresponding supportedPrincipals property, or you will create problems for any SPs that are attempting to request stronger authentication methods. It's very easy to accidentally "lie" to the world by misconfiguring the IdP, because the software can't read your mind to understand your intentions, and it only knows what you tell it. A complete more detailed explanation of how the selection process works is here. |