attribute to indicate 2-factor authN for principal

[Douglas E. Engert]

On 11/26/2013 3:51 PM, David Bantz wrote:
> As a component of phased roll-out of 2-factor authentication, we’re envisioning enabling our users to opt in to use of two-factor authentication via our IdP.
> That is, if “the paranoids” (as my CITO labeled us) set this flag, the IdP would consume an attribute from the enterprise directory and demand 2-factor authN
> from anyone presenting my identifier.  (This would not of course interfere with individual SPs requesting 2-factor or other assurance levels.)
>
> I am soliciting advice for the (LDAP) directory attribute to convey this information.

If the attribute is only used by the IDP and its database, then the choice it is up to you, the SP will never see it.
One problem, is the IDP presents a login page to the user before it knows who the user is.
So users will ha e to be trained.

> This doesn’t perfectly match other use cases I’ve seen for eduPersonAssurance,
> though the formal definition seems flexible enough to cover this use.  Would it be a good idea to use eduPersonAssurance to carry such an 2-factor opt in flag?
>

SAML2 has a number of classes to convey the type of authentication in the assertion:
http://docs.oasis-open.org/security/saml/v2.0/saml-authn-context-2.0-os.pdf

The Shibboleth X509 and Kerberos login extensions will set the X509 or Kerberos class.
Mods to the X509 package can set the SmartcardPKI.

ADFS supports some of these too:

http://msdn.microsoft.com/en-us/library/hh599318.aspx



> If a new attribute seems preferable, should be a very specific attribute with a simple yes/no value, or generalized to be able to represent yet-to-be-determined parallel uses?
>
> Thanks for your reflection, and apologies if you receive duplicate requests from cross-posting.
>
> David Bantz
> U Alaska
>
>
>
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>

-- 

  Douglas E. Engert  <DEEngert at anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444