Logic for mfa-authn-config.xml

[Paul B. Henson]

> From: Tom Scavo
> Sent: Wednesday, January 10, 2018 2:41 PM
> To: Shib Users <users at shibboleth.net>
> Subject: Re: Logic for mfa-authn-config.xml
> 
> > Applications will fall into three groups; those that do not need MFA at all,
> > those that will use MFA if available but still work with just a password
> > otherwise, and those that strictly require MFA and will fail if it does not
> > succeed. I'm not sure yet where this application delineation information will
> > be stored.
> 
> The first two groups of applications just continue to do what they've
> always been doing (i.e., no RequestedAuthnContext in the
> AuthnRequest).

Well, I don't think so, unless I'm misunderstanding something. If the application says "I'm happy with just a password" and both categories say that, how will the selection script distinguish between them in order to use MFA if available, but still succeed if not?

> The latter group of applications indicate (via
> RequestedAuthnContext in the AuthnRequest) their requirement for MFA.
> If the IdP can not satisfy that requirement, it returns a SAML error.

Ah, yes, I suppose that is true; overriding the required authentication context for those should work. Actually, I suppose both the first and last category are satisfied by simple existing functionality. It's really just the middle category that needs some special casing.

Thanks...

--
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768