Assurance Enhancements for IdPv2

[Tom Scavo]

Hi Bill,

On Fri, May 17, 2013 at 3:00 PM, William G. Thompson, Jr.
<wgthom at gmail.com> wrote:
>
> Any other thoughts on potential implementation paths...

One thought is to separate the two factors such that the second factor
is handled by the Unicon post-login handler. In this way, user
attributes would be available to the post-login handler so that user
consent could occur in conjunction with authentication via the second
factor (two birds with one stone :)

Let me give an explicit example. Suppose the second factor is Duo
Push. The post-login handler could pass the resolved user attributes
to the Duo Service so that they are displayed on the user's mobile
device. In effect, the user approves the authentication step and
attribute release at the same time. Since Duo Push depends on a
public-private key pair, the attributes could even be encrypted in
transit.

Just a thought,

Tom