Using Duo for per-SP-opt-in

[Tom Scavo]

On Wed, Jan 27, 2016 at 10:10 AM, Jorj Bauer <jorj at temple.edu> wrote:
>
> I did notice some other ... AuthnContextClass identifiers? ... that make me
> wonder what the use cases were for these and how poorly they line up. I need
> to go read more on the subject.
>
>   urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorUnregistered
>   urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract

Well, Duo is many things. It supports telephony, yes, but it also
supports (in a big way) both OATH TOTP and Duo Push, neither of which
rely on telephony. So the classes above are marginally useful at best,
and knowing where they came from (telecom providers on the Security
Services TC), I'd say they're close to no use at all.

Tom