requiring MFA for an unsolicited SSO SP

[Cantor, Scott]

> Our security folks want our AWS folks to require MFA for access to the AWS
> web console / portal.
> 
> As far as I know, AWS only supports unsolicited SSO.  Is there any way to
> force MFA on unsolicited SSO?

Securely, no. Functionally speaking, you just set defaultAuthenticationMethods on the relying party, but that's subvertable. Since you can't require a signed request, and AWS doesn't check the result, that necessitates that you install your own authorization intercept for that SP to make sure the outgoing result is what you want.

So far I've only had to do this IdP-side for SPs that I can require signed requests from, so I haven't had to do it yet, but it's inevitable.

I think we need to go ahead and implement a profile setting that disallows (meaning errors out) on any SAML request that tries to specify the authentication context. If you file that, I'll get it into 3.3.

-- Scott