requiring MFA for an unsolicited SSO SP

[IAM David Bantz]

I restrict release of the role attribute to AWS based on the authN method -
that is, release the AWS roles if and only if the authN method is MFA.

    <AttributeRule attributeID="AWSrole">
> <!--   do not release unless the authN was Duo 2FA -->
>        <PermitValueRule xsi:type="basic:AuthenticationMethodString" value=
> "https://iam.alaska.edu/trac/wiki/mfa" />
>     </AttributeRule>


David Bantz


On Mon, Sep 19, 2016 at 11:42 AM, Liam Hoekenga <liamr at umich.edu> wrote:

> Our security folks want our AWS folks to require MFA for access to the AWS
> web console / portal.
>
> As far as I know, AWS only supports unsolicited SSO.  Is there any way to
> force MFA on unsolicited SSO?
>
> Liam
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160919/1e4ac933/attachment.html>