MFA enhancements in 3.3

[Marvin Addison]

On Tue, Apr 26, 2016 at 10:49 AM Cantor, Scott <cantor.2 at osu.edu> wrote:

> Just so I'm not working in a vaccuum, I've started work in earnest on the
> planned MFA enhancements for 3.3. which I'm tracking in IDP-962.
>

Overall the design goals sound like the right ones, and what you propose in
detail sounds promising. I'll try to follow along as the work proceeds.

- Drive the MFA flow with a simple configuration that maps each transition
> from one flow to the next with plug points that are overrideable to
> determine when authentication is "done", how to combine the different
> results into one final result, and if it's not done, what flow to run next.
>

This part seems key and I'm having trouble imagining how the configuration
will be clear and straightforward. What we have today is powerful but
complex, and I'm hopeful we can move to something equally powerful but
simpler to configure for non-trivial cases.

All of the functions and conditions the code will use to decide what to do
> are injectable, and can be written with scripts of course, like everywhere
> else in the IdP. So I think most use cases should at worst just involve
> writing some scripts, not code or new webflows.
>

No code or flows sounds awesome. I'm willing to try to adapt out Duo flow
to this design once it gets in alpha or beta so we can kick the tires a bit
with a concrete implementation.

M
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160429/5635b103/attachment.html>