Where to put multifactor flows

[Cantor, Scott]

On 7/1/15, 4:35 PM, "dev on behalf of Marvin Addison" <dev-bounces at shibboleth.net on behalf of marvin.addison at gmail.com> wrote:

>I want to prevent the user navigating away from the IdP prior to completion of 2-factor auth and subsequently accessing a service on the existing session.

I think I would focus on the second half of that and not the first half. I don't think it's the job of a web page to prevent the user from navigating away, since that's impossible.

What is the authorization policy in the second half of that sentence you're trying to enforce? Can you just build an interceptor that enforces that after the fact?

The closest I can translate what you're after here is an opt-in to require a second factor for specific users for specific services, which apparently can be determined from the attributes. So why not just enforce that before proceeding with the request every time?

-- Scott