Using Duo for per-SP-opt-in

[Eric Goodman]

>>Specifically I'm looking for the analog of an SP being able to set 
>>forceAuth="true", but for 2f.

>In before Eric: ForceAuthn is different.

:)

In my defense (a) nobody responds faster than Scott and (b) I was out sick Weds and Thurs.


There is an InCommon workgroup (coming out of hiatus) trying to address some of your (Jorj's) questions about how to signal MFA, etc. So beyond Scott's clarification about the difference between ForceAuthn and AuthnContext, hopefully there will be some more specific community guidance on the actual authncontexts and other message contents coming in the near future.

--- Eric