Is it possible to make the authentication flow conditional with this plugin

[equbaykiflay]

Hi there,
Thanks for this wonderful plugin. I was able to make the version 1.1.0 plugin work with Shibboleth idP5 version 5.1.2 by using the mfa-authn-config.xml authentication flow setup example in the privacyidea.properties file you provided. The only problem with it is, in our setup, we need to make the flow conditional so users who don't have token can login to setup token and enable two-factor authentication.
Our current Shibboleth/privacyIDEA setup which uses an old linOTP based custom plugin, privacyIDEA-shibboleth-tfa, which doesn't work with Shibboleth 5, users something like this in mfa-authn-config.xml authentication flow setup

<util:map id="shibboleth.authn.MFA.TransitionMap">
    <entry key="">
        <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/Password" />
    <entry key="authn/Password">
        <bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkFor2FAToken" />
    </entry>
</util:map>
<bean id="tokenGenerator" class="ca.ab.concordia.privacyIDEAtfa.TokenGenerator"
            p:host="%{privacyidea.server:localhost}"
            p:serviceUsername="%{privacyidea.service_name:admin}"
            p:servicePassword="%{privacyidea.service_pass:secret}"
            p:checkCert="%{privacyidea.verify_ssl:true}"
            p:createEmailToken="%{pi.CreateEmailToken:false}"
            p:httpServletRequestSupplier-ref="shibboleth.HttpServletRequestSupplier"/>
<bean id="checkFor2FAToken" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"
    p:customObject-ref="tokenGenerator">
    <constructor-arg>
        <value>
        <![CDATA[
            nextFlow = "authn/privacyidea";
            authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
            mfaCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");
            if (mfaCtx.isAcceptable()) {
              // Get username
              usernameLookupStrategyClass = Java.type("net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy");
              usernameLookupStrategy = new usernameLookupStrategyClass();
              username = usernameLookupStrategy.apply(input);
              tokenExists = custom.tokenExistsForUser(username);
              if (tokenExists == false) {
                logger.debug("No token found for {}.  Skipping 2FA screen.", username);
                nextFlow = null;
              } else {
                logger.debug("Token(s) found for {}. Proceeding to authentication.", username);
              }
            }
            nextFlow;   // pass control to second factor or end with the first
        ]]>
        </value>
    </constructor-arg>
</bean>

Would it be possible to configure the privacyIDEA plugin v.1.1.0 similarly? What would be the beans configuration to get this conditional flow with the current plugin.

Thank you,
Equbay

[equbaykiflay]

I got this to work by setting PrivacyIdea authentication policy passOnNoToken to true. To do that you go to config->policies.