Logic for mfa-authn-config.xml

[Paul B. Henson]

> From: Peter Schober
> Sent: Thursday, January 11, 2018 8:24 AM
> 
> I may be restarting what Andrew and Tom already said but AFAIU that
> second group of service doesn't exist: Either the service requires MFA
> (and states that much in its request or in your local config) or it
> doesn't (meaning it will take what it gets).

That's not what my management says ;). I think there's a general misunderstanding to my question; I'm talking about random cloud services over which we have absolutely no control whether or not the application itself asserts a requirement for MFA, but that we have determined a local policy for. I understand I could override the required authentication context locally for a given SP, but again that is an all or nothing, either it just won't ask for MFA or it will strictly require MFA.

> Not sure that helps (or is accurate) but maybe reducing the possible
> states to two (force MFA or don't) makes this easier for you?

Not really :). Per intended security policy there is a third possible state: an application which will require MFA for user accounts which are enrolled in duo and can do it, but succeed without it for user accounts which are not enrolled in duo and aren't capable of MFA...

There's really no one who has ever done opportunistic MFA before for an audience of users not all of whom have it available?

Thanks...

--
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768