Multiple authentication levels for a single application

[Guillaume Rousse]

Le 27/08/2019 à 14:23, Cantor, Scott a écrit :
>> Either I need a way for the SP to issue two different kind of login requests, each using a different content in
>> <samlp:RequestedAuthnContext> element, so as to have a single IdP select the correct authentication flow
>> accordingly. I guess using different session initiators handlers, at different URLS, would be enough, but then I'll need
>> different authentication links/buttons in the application ( "login as user", and "login as admin").
> 
> The redirection protocol for passively initiating sessions in the SP has parameters for setting the context class, so you don't need anything but some code, and you need code in the application to do anything like this no matter what.
Indeed, it would reduce required SP configuration. However, I'd still 
need additional UI elements on the application itself to select the 
correction authentication method, which is quite invasive for a 
federated application, accessible to a whole community. Hence my 
preference for the two other strategies sofar (using multiple IdPs to 
externalise user choice, or smart MFA flow to embed the decision in IdP 
configuration).

Regards.
-- 
Guillaume Rousse
Pôle SSI

Tel: +33 1 53 94 20 45
www.renater.fr

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3637 bytes
Desc: Signature cryptographique S/MIME
URL: <http://shibboleth.net/pipermail/users/attachments/20190827/1c7db663/attachment.p7s>