MCB SSO not requiring greater authentication methods

[Ho, PeiQuan]

In the way you suggested, how would the SP know which auth method the user should use and dynamically send a different one to the IDP?

The way we have our IDP setup is we have a backend DB that has a lookup table for the SPs.  If the table says the SP requires two-factor, or if the SP offers opt-in and the user has opt-in, the MCB theoretically should two-factor the user.

Thanks,
-PQ

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Paul Hethmon
Sent: Friday, April 10, 2015 11:56 AM
To: Shibboleth Users
Subject: Re: MCB SSO not requiring greater authentication methods

The correct (and easiest) way to do that is to have the SP request it. Either initially or it could send the user back to the IdP with the higher context value to “upgrade” their authentication.

The MCB does a lot, but it can’t mind read the SP.

> On Apr 10, 2015, at 11:47 AM, Ho, PeiQuan <PeiQuan.Ho at tufts.edu> wrote:
> 
> The reason we are using a scripted attribute is because we want to give the SP the option of offering user opt-in two-factor.  We maintain the user opt-in information in the backend and the IDP needs to determine the value for each SP and user before deciding which authentication method to present.

-----
Paul Hethmon
Chief Software Architect
paul.hethmon at clareitysecurity.com


-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net