Feedback on Multi-Context Broker Community Contribution

[Tom Scavo]

On Mon, Oct 21, 2013 at 4:47 PM, Paul Hethmon
<paul.hethmon at clareitysecurity.com> wrote:
>
> On 10/21/13 4:39 PM, "Tom Scavo" <trscavo at gmail.com> wrote:
>
>>Are you saying that the MCB will recognize and act on a <Subject>
>>element in the <AuthnRequest> or are you signaling step-up
>>authentication in some other way?
>
> It's handled strictly by the requested authentication context in the
> AuthnRequest. So if the SP requests "TwoFactor" and you've authenticated
> with "Password", then the MCB will make you authenticate again with the
> method associated with "TwoFactor". There is also a caveat that your user
> identity is allowed to authenticate with "TwoFactor".

I think you've answered my question (in the negative) but let me probe
further to be sure. It seems you're assuming that one IdP is
responsible for all factors for a particular user. My use case doesn't
make that assumption. I'm talking about an IdP that will authenticate
a *known* user for which it may have no session. The SP passes the
identity of the user in a <Subject> element in the request. Based on
that identity, the IdP now knows the user it must authenticate again.

This is a perfect match for Duo, btw. When the IdP sends a authn
request to the Duo Service, it passes an identifier for the user so
that Duo can map that identifier to the correct Duo user. That's how
the current Duo Login Handler works---it authenticates the user with a
password and then passes the resulting identifier to the Duo Service.

I want to bypass that password authentication step by including an
identifier for the user right in the AuthnRequest. Will the MCB handle
that use case?

Thanks,

Tom