MCB with Duo and password as fallback

[Wessel, Keith]

Correct: strong auth doesn't work if you also allow weak. Our idea is to use the authncontext passed back into the application to see how the user authenticated and grant access accordingly.

For instance, our password changing tool allows end users to change their own passwords and IT folks to change others' passwords in addition. We could only allow changing of others' passwords for an authorized user if (1) they're authorized and (2) they logged in using MFA. In that case, we're detecting the difference inside the application. If you're getting the same thing with just a password as you are with MFA, I'm with you: why bother pulling out your phone?

Keith


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, August 20, 2014 9:35 PM
To: Shib Users
Subject: Re: MCB with Duo and password as fallback

On 8/20/14, 10:20 PM, "Wessel, Keith" <kwessel at illinois.edu> wrote:

>You are correct, Scott. Initial contexts are used when the user doesn't 
>yet have a session. So, that doesn't come into play for previous 
>session handling. My point was simply that, in the case that a new user 
>comes along, there seems to be a problem satisfying X if Y is allowed 
>as an initial context but X isn't. Y gets satisfied, and the MCB runs with it.

Well, a problem in the strictest sense. In the more general sense the SP did say password was ok, so the problem is in not getting the best you can get, in exchange for more user convenience.

There's a valid case to be made that if you want something better, you shouldn't accept something worse and expect not to get it. This is exacerbated if the user has the ability to choose or to signal to the strong method that they'd prefer the weak. Given a choice, I'm going to pick the thing I don't have to pull out my phone for.

Strong auth basically doesn't work if you also allow weak, IMHO.

>Previous sessions are a different but somewhat similar situation. If 
>the SP asks for X and Y and I already have a session with Y, the MCB 
>again seems to run with it.

It's exactly the same situation; once you're past "initial", you have a session and it operates the same for that SP as the next one. It certainly ought to, anything else would be very confusing.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net