MFA for Incommom members

[NAINI, NIKHIL]

David, enabling the opt-in MFA would basically make them MFA for every Shibboleth login site, wouldn’t it? The University is just implementing the MFA on sites containing PII data, doesn’t want to enforce it across all the login pages. This would also require that we identify all the users who use the ApplyWeb and keep a track of any new additions/removals and track their MFA options. Is there any other option?

From: users <users-bounces at shibboleth.net> On Behalf Of IAM David Bantz
Sent: Tuesday, July 2, 2019 1:45 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: MFA for Incommom members

A possible option that might meet your requirements would be to require MFA at the IdP based on the principal;
an attribute in the principal's (LDAP) record can trigger the MFA for persons, but not for the service accounts.

We currently allow opt-in to MFA and use a value of LDAP attribute eduPersonAssurance to trigger MFA for those who opt in.

David Bantz
UA OIT IAM

On Tue, Jul 2, 2019 at 8:47 AM Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:
> Are there any other ways the Endpoint URL can be extracted and used to apply MFA on ?

It's ill-advised; there is no support for applying policy to a request beyond the entityID, to avoid tying yourself to details of a deployment that are in no way assumed to be stable. Those URLs are not "applications" in the sense that you're trying to attach meaning to.

To the extent that it would ever be done, it should be done with RelayState by agreeing to specific values amongst the parties that signal the appropriate things. That's not good, but it's better than relying on the endpoints.

-- Scott


--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg<https://protect2.fireeye.com/url?k=5bd2b4e7-07408ce4-5bd2fa26-002590f4ed8c-4faa27e15ab178b0&q=1&u=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190703/c4f2e4a3/attachment.html>