Using Duo for per-SP-opt-in

[Cantor, Scott]

On 1/27/16, 10:53 AM, "users on behalf of Jorj Bauer" <users-bounces at shibboleth.net on behalf of jorj at temple.edu> wrote:


>
>Specifically I'm looking for the analog of an SP being able to set 
>forceAuth="true", but for 2f.

In before Eric: ForceAuthn is different.

An SP requiring a context class says "SSO via a cookie is fine, but make sure initial authentication was done in X manner".

ForceAuthn says "mumble, florp, garble". No, but seriously, it says something about "please don't do SSO but I can't really say exactly what that means", and with Duo it isn't really established practice what it means. Might mean do both factors again, might mean at least one, etc.

-- Scott