Influence MFA authentication flow based on Username alone for phased 2FA deployment

[Nadim El-Khoury]

Hi Nate,

Thank you for the detailed information and steps. I will post back once I
get the flow working.

We are going to use Trusona
<https://www.trusona.com/why-trusona/passwordless-mfa> 2FA passwordless
solution. In the beginning, they did not provide any integration with
Shibboleth, but after talking to other universities and us, they added
Shibboleth as one of their supported applications. You might want to look
at their solution.

Best,

Nadim El-Khoury
Director of Networks, Systems, Infrastructure, and Information Security
Officer
Springfield College
263 Alden Street
Springfield, MA 01109
email: nel-khoury at springfield.edu



On Fri, Jul 2, 2021 at 9:18 PM Nate Klingenstein <ndk at signet.id> wrote:

> Nadim,
>
> I believe you could set up a flow that does that by presenting a page for
> username entry, then using a JavaScript comparison against a derived
> principal(or even the username as entered) in your MFA script as a
> conditional means to pick which flow to proceed to.  Part of the
> conditional flow example in the Wiki could help, but development of the
> complete set of flows and scripting will be a meaningful amount of work.
>
>
> https://wiki.shibboleth.net/confluence/display/IDP4/MultiFactorAuthnConfiguration
>
> However, I'm also curious how the 2FA/MFA solution works.  Usually, I hear
> 2FA defined as serial presentation of a combination of "something you know"
> and "something you have" and "something you intrinsically are", and MFA as
> simultaneous presentation of those.  It doesn't sound like "something you
> know" is a part of this, so I wonder what the two factors look like, given
> some of the challenges "something you intrinsically are" can present.
>
> https://en.wikipedia.org/wiki/Multi-factor_authentication
>
> Take care,
> Nate.
>
> --------
> Signet, Inc.
> The Art of Access ®
>
> https://www.signet.id
>
> -----Original message-----
> From: Nadim El-Khoury via users
> Sent: Saturday, July 3 2021, 1:00 am
> To: users at shibboleth.net
> Cc: Nadim El-Khoury
> Subject: Influence MFA authentication flow based on Username alone for
> phased 2FA deployment
>
> Hi Everyone,
>
> Is there a way to influence MFA authentication flow based on the Username
> alone?
>
> We want to phase the deployment of 2FA based on whether the user is part
> of phase1, phase2, and so forth. Our 2FA is passwordless and does not
> require the user to enter their username and password.
>
> So, we want only to display the Username field on the Login page. The user
> enters their username, and we determine whether to display the password
> field or send them to our 2FA passwordless SAML setup.
>
> I read most of the threads about MFA and went over the documentation, and
> there was one topic where the MFA flow was modified based on relying party.
>
> Best,
>
> Nadim El-Khoury
>
> Director of Networks, Systems, Infrastructure, and Information Security
> Officer
>
> Springfield College
>
> 263 Alden Street
>
> Springfield, MA 01109
>
> email: nel-khoury at springfield.edu <mailto:nel-khoury at springfield.edu>
>
> --
>
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
>
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210704/f4707724/attachment.htm>