IDP 3.3 MFA flow -- checking to see if an authn context class ref was requested

[Wessel, Keith]

That's completely true, but that's not how our Security folks are seeing it right now. Fact remains that an empty authentication context class ref from the SP should behave as it did in the days before Duo and not prompt for Duo.

Eventually, and probably sooner than eventually, we'll just require Duo authentication for everything, and the user will be out of luck if they haven't signed up and aren't on campus to do so. But that's still a little ways off, sadly.

So, given that, am I stuck checking the list of requested authn contexts as I suspected to begin with?

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, December 05, 2016 2:38 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: IDP 3.3 MFA flow -- checking to see if an authn context class ref was requested

> Our specific case is based on:
> (1) not everyone has Duo tokens yet, so I can't just make a simple MFA flow
> of always do password then Duo

I understand that it's conditional based on the user.

> (2) Some SPs will request Duo, others will request Duo or Password in that
> order, others won't request anything in which case password is sufficient for
> now.

Requesting Duo or Password together is really the same as requesting nothing, in essentially all the cases you're thinking about, because those are the only two methods on the table here. That's the only point I'm trying to make.
 
> In the case where either Duo or Password are requested, the isAcceptable
> method will work. But if both are requested by the SP, won't isAcceptable
> always return true once the user has satisfied password? If so, Duo will never
> happen.

I'm saying if you want it to happen anyway, you probably want it to happen based on the user being enrolled or being in some category, not based on the SP. Most SPs request nothing. If you don't force Duo for them, you're gaining nothing all that significant by forcing it in the tiny set of cases where an SP requests both, and you lose out on a lot of additional use of MFA.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net