Security Risk for supporting MFA for SPs not requesting it?

[Cantor, Scott]

> I read some threads recently related to issues supporting MFA for SPs that do
> not request it. Is there a thread or document that discusses security issues
> related to this?

The documentation discusses it alongside the example of configuring it. The IdP "forcing" it only applies if the SP doesn't request something itself, ergo just forge an AuthnRequest from an SP to request PasswordProtectedTransport and you subvert the IdP rule.

Thus, you have to block the option to request it which was what the disallowedFeatures setting was added to support.

-- Scott