attribute to indicate 2-factor authN for principal

[Michael A Grady]

This is probably a better discussion for MACE-DIR (of which you have some familiarity :-) than the Shib Users group. A number of institutions have implemented opt-in MFA, along with a variety of alternative strategies for a user to at least temporarily "opt back out" if necessary. Penn, Duke, MIT (in progress) come quickly to mind. So perhaps it is least time to discuss any value in standard practice/naming around this. Of course, that's separate from a discussion as to how convey this "on the wire" as an authn context, which is more closely tied to this list.

On Nov 26, 2013, at 4:58 PM, David Bantz wrote:

> 
> On Tue, 26 Nov 2013, at 13:28 , Douglas E. Engert <deengert at anl.gov> wrote:
> 
>> On 11/26/2013 3:51 PM, David Bantz wrote:
>>> As a component of phased roll-out of 2-factor authentication, we’re envisioning enabling our users to opt in to use of two-factor authentication via our IdP.
>>> That is, if “the paranoids” (as my CITO labeled us) set this flag, the IdP would consume an attribute from the enterprise directory and demand 2-factor authN
>>> from anyone presenting my identifier.  (This would not of course interfere with individual SPs requesting 2-factor or other assurance levels.)
>>> 
>>> I am soliciting advice for the (LDAP) directory attribute to convey this information.
>> 
>> If the attribute is only used by the IDP and its database, then the choice it is up to you, the SP will never see it.
>> One problem, is the IDP presents a login page to the user before it knows who the user is.
>> So users will ha e to be trained.
> 
> Yes, this is an attribute to be consumed (only) by the the IdP to “switch on” the additional request for second factor;
> we’re not envisioning encoding the attribute and sending to the SP.
> 
> As you note, the initial default IdP login page remains unaware of any aspect of 2-factor authN; a subsequent page requesting
> verification of the second factor will presented to (only) those users who opt in as indicated by the directory attribute.
> 
> David Bantz
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.