Electronic signatures

[Eric Goodman]

>>(This is all assuming that the IdP supports ForceAuthn, and is using an 
>>authentication method for which that has a reasonable interpretation.)

>Which is a big assumption.

My (additional) assumption has always been that if you want to use ForceAuthn in this way that you need to audit the IdPs to ensure this behavior, or at least document it clearly to the IdP leveraging your service, since it's so common for IdPs to be out of compliance or to be in compliance in meaningless ways (e.g., kerb/IWA). 

FWIW, I have agitated for auditing the ForceAuthn response behavior of the IdPs in my system as a prelude to leveraging ForceAuthn this way, but I don't see any realistic way to support it federation-wide short of something like a trustmark. (And I think the development of such a trustmark is not high on anyone's priority list.) Also, at least half of the IdP operators I've talked to are generally resistant to SPs using ForceAuthn since it "breaks" SSO; part of the argument being that use of ForceAuthn potentially encourages poor user behavior (e.g., saving passwords in the browser) that could be as detrimental to authentication security as what is added by use of ForceAuthn in the firstplace. 

--- Eric