Logic for mfa-authn-config.xml

[David Walker]

On 01/11/2018 06:44 PM, Paul B. Henson wrote:
>> From: David Walker
>> Sent: Thursday, January 11, 2018 9:00 AM
>>
>> The second group would be applications that tailor the access they provide
>> based on the type of authentication performed, perhaps later requesting
>> (and requiring) MFA when sensitive/risky transactions are attempted.
> Well, actually, in my classification that is a completely new category I hadn't even considered yet 8-/. Although doesn't that just work out-of-the-box; initially the application asserts a password context and then later forces a reauth requiring an MFA context?

Probably not germane to where this thread is going, but right, it
requires the application to control authentication events based on what
the user is doing.

> My second group are applications that once you authenticate successfully you get to use without any future context changes, but that will do MFA if a user can but not fail if they can't.
>
> Thanks…
>
> --
> Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
> Operating Systems and Network Analyst  |  henson at cpp.edu
> California State Polytechnic University  |  Pomona CA 91768
>
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180112/e06b9148/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/users/attachments/20180112/e06b9148/attachment.sig>