MFA enhancements in 3.3

[Cantor, Scott]

After the "vacation" working on the SP, I'm finally back to this work again and have made substantial progress on a framework I'm getting close to happy with.

I have checked in a simple example of using this new MFA feature to combine two existing flows, IPAddress and Password. Obviously you could substitute other factors (e.g. Password and Duo), the interesting part is how it combines them.

The entire configuration for this is in one new file:

http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-conf/src/main/resources/conf/authn/mfa-authn-config.xml?revision=8285&view=markup

If you browse back into the history you'll see how this has evolved, and it's gotten much shorter each iteration.

Anyway, what the example does in plain English is:

Run the first factor (IPAddress). If that works, it runs a script that's in that file, which does the following:

If the first factor alone doesn't satisfy the request, it directly passes to the second factor. If it does satisfy the request, it looks up an attribute about the user identified by the first factor. If the attribute is found and contains a value matching the first factor, it "authorizes" that result. If not, it passes to the second factor.

The end result is either the first factor (if allowed) or a merged result of both factors.

There's no UI here, and no example of using an additional webflow between the factors, but that is quite possible. This is just using a script to branch, but control could pass to a custom webflow that could pop up a view and collect input, and then a rule would be configured to pick up from that step and examine the input to decide what to do.

A common/simple pattern would just be a very short script that examines the first factor result to see if it's "enough" and then decide whether to stop or add another factor, basically what's there minus the attribute check.

-- Scott