Multiple authentication levels for a single application

[Cantor, Scott]

On 8/27/19, 11:12 AM, "users on behalf of Guillaume Rousse" <users-bounces at shibboleth.net on behalf of guillaume.rousse at renater.fr> wrote:

> Hence my preference for the two other strategies sofar (using multiple IdPs to 
> externalise user choice, or smart MFA flow to embed the decision in IdP 
> configuration).

Using the IdP to decide is impractical for a federated application because you don't have any influence over what the (potentially many) IdPs choose to support for authentication and they don't specifically care about your application, it's just one of many.

So either the app really is federated, in which case the SP must ask for what it wants and can assume nothing about the IdPs, or it's not, in which case the IdP could do some of the work and probably will. But the IdP can't do anything fine grained since it has no idea what the user is doing in the application. Differential access based on different login methods is something the app has to support, which is why it's rarely done.

-- Scott