Influence MFA authentication flow based on Username alone for phased 2FA deployment

[Nate Klingenstein]

Nadim,

I believe you could set up a flow that does that by presenting a page for username entry, then using a JavaScript comparison against a derived principal(or even the username as entered) in your MFA script as a conditional means to pick which flow to proceed to.  Part of the conditional flow example in the Wiki could help, but development of the complete set of flows and scripting will be a meaningful amount of work.

https://wiki.shibboleth.net/confluence/display/IDP4/MultiFactorAuthnConfiguration

However, I'm also curious how the 2FA/MFA solution works.  Usually, I hear 2FA defined as serial presentation of a combination of "something you know" and "something you have" and "something you intrinsically are", and MFA as simultaneous presentation of those.  It doesn't sound like "something you know" is a part of this, so I wonder what the two factors look like, given some of the challenges "something you intrinsically are" can present.

https://en.wikipedia.org/wiki/Multi-factor_authentication

Take care,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id

-----Original message-----
From: Nadim El-Khoury via users
Sent: Saturday, July 3 2021, 1:00 am
To: users at shibboleth.net
Cc: Nadim El-Khoury
Subject: Influence MFA authentication flow based on Username alone for phased 2FA deployment

Hi Everyone,

Is there a way to influence MFA authentication flow based on the Username alone?

We want to phase the deployment of 2FA based on whether the user is part of phase1, phase2, and so forth. Our 2FA is passwordless and does not require the user to enter their username and password.

So, we want only to display the Username field on the Login page. The user enters their username, and we determine whether to display the password field or send them to our 2FA passwordless SAML setup.

I read most of the threads about MFA and went over the documentation, and there was one topic where the MFA flow was modified based on relying party.

Best,

Nadim El-Khoury

Director of Networks, Systems, Infrastructure, and Information Security Officer

Springfield College

263 Alden Street

Springfield, MA 01109

email: nel-khoury at springfield.edu <mailto:nel-khoury at springfield.edu>

--

For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net