opt-in 2fa

[Cantor, Scott]

On 9/5/13 3:34 PM, "Liam Hoekenga" <liamr at umich.edu> wrote:

>Some of our campus service providers have approached us asking for a
>way to allow users to opt-in to 2fa on a service-by-service basis (for
>services that would not normally require it).
>
>We're just starting to have this conversation, and I'm looking for
>ideas or suggestions as to how one might implement this using
>shibboleth.

You'd have to be more specific about the details of what you want it to
do. The answer is likely to be a custom login handler regardless, at which
point it really is entirely up to you what it does.

I support SecurID as a fallthrough on the same form that handles password
authentication, which is, I suppose one way to "opt-in", but that isn't
necessarily what you mean by it.

There is certainly no way to "force" somebody to use MFA on a user basis
(e.g., opt-in to requiring it) unless you implement state at the SP or the
IDP, at which point the details depend on which end you choose.

-- Scott