Logic for mfa-authn-config.xml

[David Walker]

The second group would be applications that tailor the access they
provide based on the type of authentication performed, perhaps later
requesting (and requiring) MFA when sensitive/risky transactions are
attempted.

David


On 01/11/2018 08:24 AM, Peter Schober wrote:
> * Paul B. Henson <henson at cpp.edu> [2018-01-10 22:40]:
>> Applications will fall into three groups; those that do not need MFA
>> at all, those that will use MFA if available but still work with
>> just a password otherwise, and those that strictly require MFA and
>> will fail if it does not succeed. I'm not sure yet where this
>> application delineation information will be stored.
> I may be restarting what Andrew and Tom already said but AFAIU that
> second group of service doesn't exist: Either the service requires MFA
> (and states that much in its request or in your local config) or it
> doesn't (meaning it will take what it gets).
>
> Not sure that helps (or is accurate) but maybe reducing the possible
> states to two (force MFA or don't) makes this easier for you?
>
> -peter

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180111/1968d8e6/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/users/attachments/20180111/1968d8e6/attachment.sig>