Best way to enable MFA globally?

[Klingenstein, Nate]

Brandon,

You have a thousand ways to do it, but there are subtle differences between those methods.

For instance, setting the default authentication method like that will only work with sites don't signal another authentication method.  That might be what you want, but it sounds like you want to force this for everything.

To really force it for everything, I would use the MFA implementation and set the next flow to Duo as you describe.

There are other ways you could go about this, and they're all nuanced, but that is how I would most completely bring down the hammer.

I would also make sure that you won't run into any issues regarding signaled AuthnContexts in either direction with various services before bringing down the hammer.  You can do that on a test node.

Hope this helps,
Nate.

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of McKean, Brandon Scott - mckeanbs
Sent: Monday, January 29, 2018 1:47 PM
To: users at shibboleth.net
Subject: Best way to enable MFA globally?


Hi Everyone,



We're looking to force Duo usage for everything starting in a few months. I'm wondering what the recommended way of handling this configuration is. My best guess is that it would be done in the relying-party.xml using something like:



<bean parent="SAML2.SSO">

<property name="defaultAuthenticationMethods">

<list>

<ref bean="mfa"/>

</list>

</property

</bean>



.. by default and for any overrides already specified.



Though I suspect it could also be done in mfa-authn-config.xml by always setting nextFlow to "authn/Duo".



Any guidance on this would be appreciated.



Thanks,


--Brandon
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180129/a5d6a284/attachment.html>