SP Requiring/Requesting MFA (was Re: Customizing Second Factor Configuration in mfa-authn-config.xml)

[Cantor, Scott]

On 4/26/21, 11:49 AM, "users on behalf of Ullfig, Roberto Alfredo" <users-bounces at shibboleth.net on behalf of rullfig at uic.edu> wrote:

>    OK, this SP is sending this:

That doesn't really tell me what it is your IdP is actually programmed to do, but the example material would result in such an IdP honoring first-factor-only both initially and on reuse because the SP is saying that password alone is just fine. Order rarely matters in these cases unless there are very separate and discrete mechanisms in play. Duo doesn't work like that, it's piggybacking on something else.

>If it's not available it ends up using urn:oasis:names:tc:SAML:2.0:ac:classes:Password -  But there's nothing in
> this SP's metadata indicating this.

There is no such metadata to indicate it.

>    The problem here is that if we enable MFA, we can't determine which SPs are passing this authncontext so
> we don't know which applications will be impacted by our change - unless we enable debug mode for a period
> of time and check our logs.

Or you don't do anything globally. But yes, that's true. If you want to know what something is doing, you have to log it. I'm not sure why that would be a revelation or why it's an issue.

As for the logging, no, you don't do it on DEBUG and just look at XML, you audit it. Requested AuthnContext content can be added to the audit log.

-- Scott