Federation and Multifactor Authentication

[Cantor, Scott]

On 4/25/12 12:06 PM, "Castellow, Robert" <castellr at musc.edu> wrote:

>Hello:
>I am researching using multifactor authentication using the MFA Login
>handler in Shibboleth, and I¹m trying to understand the workflow for
>federated identities that use services within our organization.
>
> 
>If a user authenticates within another organization and they have an
>active Shibboleth session and try to visit a service provider within our
>organization, is it implied that we continue to trust our federated
>partners but are adding an
> extra level of security in authenticating our own users through MFA on
>our local IdP?

That isn't a normal use of Shibboleth or federated identity. If you wanted
to do that, then that's up to you, but that involves putting all SPs
behind a gateway/proxy IdP, essentially.

>  It seems that even though we are requiring a certain level of
>authentication within our own accounts, that we may or may not receive
>the same level of security from our
> partners.  Is this correct?

That's a good way to put it.

If you require specific behavior from partners, you're talking about out
of band agreements, federation-imposed policy, and/or use of AuthnContext
and/or the concepts of "assurance" to request and describe the behaviors
of the IdPs.

The more you want to control, the harder it all gets and the less well it
all works. You'll find that to be true across all federating technologies.

-- Scott