Influence MFA authentication flow based on Username alone for phased 2FA deployment

[Nadim El-Khoury]

Hi Nate,

I am not sure how many are aware of it; Duke University developed its own
internal Password-less solution called Duke Unlock.

https://meetings.internet2.edu/media/medialibrary/2019/12/05/20191210-patel-webauthn.pdf
https://www.incommon.org/news/duke-unlock-one-step-multi-factor/
https://oit.duke.edu/what-we-do/applications/duke-unlock

Best,

Nadim El-Khoury
Director of Networks, Systems, Infrastructure, and Information Security
Officer
Springfield College
263 Alden Street
Springfield, MA 01109
email: nel-khoury at springfield.edu

On Sun, Jul 4, 2021 at 8:50 AM Nadim El-Khoury <nel-khoury at springfield.edu>
wrote:

> Hi Nate,
>
> Thank you for the detailed information and steps. I will post back once I
> get the flow working.
>
> We are going to use Trusona
> <https://www.trusona.com/why-trusona/passwordless-mfa> 2FA passwordless
> solution. In the beginning, they did not provide any integration with
> Shibboleth, but after talking to other universities and us, they added
> Shibboleth as one of their supported applications. You might want to look
> at their solution.
>
> Best,
>
> Nadim El-Khoury
> Director of Networks, Systems, Infrastructure, and Information Security
> Officer
> Springfield College
> 263 Alden Street
> Springfield, MA 01109
> email: nel-khoury at springfield.edu
>
>
>
> On Fri, Jul 2, 2021 at 9:18 PM Nate Klingenstein <ndk at signet.id> wrote:
>
>> Nadim,
>>
>> I believe you could set up a flow that does that by presenting a page for
>> username entry, then using a JavaScript comparison against a derived
>> principal(or even the username as entered) in your MFA script as a
>> conditional means to pick which flow to proceed to.  Part of the
>> conditional flow example in the Wiki could help, but development of the
>> complete set of flows and scripting will be a meaningful amount of work.
>>
>>
>> https://wiki.shibboleth.net/confluence/display/IDP4/MultiFactorAuthnConfiguration
>>
>> However, I'm also curious how the 2FA/MFA solution works.  Usually, I
>> hear 2FA defined as serial presentation of a combination of "something you
>> know" and "something you have" and "something you intrinsically are", and
>> MFA as simultaneous presentation of those.  It doesn't sound like
>> "something you know" is a part of this, so I wonder what the two factors
>> look like, given some of the challenges "something you intrinsically are"
>> can present.
>>
>> https://en.wikipedia.org/wiki/Multi-factor_authentication
>>
>> Take care,
>> Nate.
>>
>> --------
>> Signet, Inc.
>> The Art of Access ®
>>
>> https://www.signet.id
>>
>> -----Original message-----
>> From: Nadim El-Khoury via users
>> Sent: Saturday, July 3 2021, 1:00 am
>> To: users at shibboleth.net
>> Cc: Nadim El-Khoury
>> Subject: Influence MFA authentication flow based on Username alone for
>> phased 2FA deployment
>>
>> Hi Everyone,
>>
>> Is there a way to influence MFA authentication flow based on the Username
>> alone?
>>
>> We want to phase the deployment of 2FA based on whether the user is part
>> of phase1, phase2, and so forth. Our 2FA is passwordless and does not
>> require the user to enter their username and password.
>>
>> So, we want only to display the Username field on the Login page. The
>> user enters their username, and we determine whether to display the
>> password field or send them to our 2FA passwordless SAML setup.
>>
>> I read most of the threads about MFA and went over the documentation, and
>> there was one topic where the MFA flow was modified based on relying party.
>>
>> Best,
>>
>> Nadim El-Khoury
>>
>> Director of Networks, Systems, Infrastructure, and Information Security
>> Officer
>>
>> Springfield College
>>
>> 263 Alden Street
>>
>> Springfield, MA 01109
>>
>> email: nel-khoury at springfield.edu <mailto:nel-khoury at springfield.edu>
>>
>> --
>>
>> For Consortium Member technical support, see
>> https://wiki.shibboleth.net/confluence/x/coFAAg
>>
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>>
>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210704/0dfec3be/attachment.htm>