Customizing Second Factor Configuration in mfa-authn-config.xml

[Cantor, Scott]

> So to enable MFA for just one SP (Shibboleth) I do something like this?

Mechanically yes, but not specifically, no. "MFA" is not a Principal, it's a login flow. Flows are associated with custom Principals, particularly in the case of SAML 2 of a certain type that represents AuthnContextClassRefs. Those class refs are the abstractions that define how authentication quality is measured and expressed.

Attaching the Principal(s) to flows via their supportedPrincipals property and then to overrides via their defaultAuthenticationMethods property is what connects them.

AC class refs are URIs, not just "MFA". e.g. the REFEDS MFA context value, whose value is not in front of me just this second.

-- Scott