Configuring MFA triggers in 3.3

[Cantor, Scott]

> We are wondering if anyone else has implemented Duo/MFA to be triggered
> only on un-trusted networks.

We have an isolated case of it and the volume was such that it was simpler to just let the Duo bypass feature deal with it for the time being. It was a union contract thing.

> Specifically if the SP is requesting an MFA authentication by specifying an
> authnContextClassRef, should we allow the IDP to lie to the SP that the
> context was satisfied?

Well, nobody can really answer that except you. If you're asking me, no, I don't think that's fair, particularly at the scale/scope you're proposing. That's a huge number of transactions to be lying about IMHO. But if you're asking me if you can make it lie, yes, though I haven't really thought much about what that takes.

> Alternatively, we could leave SPs requesting nothing additional in their
> authnContextClassRef and have the IDP determine when an MFA auth is
> required; is that safe and scalable?

Depends how many apps you want to take on that job for, and bear in mind that it also means you probably own the "turn off Duo" responsibilty in the event that Duo was down. Our view here has been to encourage the app to make that decision since it's their risk to accept password logins, not one central decision for everybody.

Is it hard to impose, though? No, not really. You do, though, need to either require signed requests and/or disable the ability for SPs to request an AuthnContext, or your rule will be circumventable.

There will always be services that require you impose the requirement for them anyway.

-- Scott