Influence MFA authentication flow based on Username alone for phased 2FA deployment

[Nadim El-Khoury]

Hi Nate,

If you want to see how Trusona is currently integrated with our IDP
instance.
You can go to the link below, type Springfield College, and be redirected
to our IDP. You can click on the "Sign In using Trusona." The user is taken
to Trusona and presented with a QR code. The user would have
already registered their phone. Please note that the current setup is for
testing, and I am still working on modifying the login page and the flow.
https://fedsp-stage.ccp.xcal.tv/auth?continue=https://fedsp-stage.ccp.xcal.tv/parseJWT&tenant=tester&usePing=true&xoc-school-i

Best,

Nadim

On Sun, Jul 4, 2021 at 9:32 AM Nadim El-Khoury <nel-khoury at springfield.edu>
wrote:

> Hi Nate,
>
> I am not sure how many are aware of it; Duke University developed its own
> internal Password-less solution called Duke Unlock.
>
>
> https://meetings.internet2.edu/media/medialibrary/2019/12/05/20191210-patel-webauthn.pdf
> https://www.incommon.org/news/duke-unlock-one-step-multi-factor/
> https://oit.duke.edu/what-we-do/applications/duke-unlock
>
> Best,
>
> Nadim El-Khoury
> Director of Networks, Systems, Infrastructure, and Information Security
> Officer
> Springfield College
> 263 Alden Street
> Springfield, MA 01109
> email: nel-khoury at springfield.edu
>
> On Sun, Jul 4, 2021 at 8:50 AM Nadim El-Khoury <nel-khoury at springfield.edu>
> wrote:
>
>> Hi Nate,
>>
>> Thank you for the detailed information and steps. I will post back once I
>> get the flow working.
>>
>> We are going to use Trusona
>> <https://www.trusona.com/why-trusona/passwordless-mfa> 2FA passwordless
>> solution. In the beginning, they did not provide any integration with
>> Shibboleth, but after talking to other universities and us, they added
>> Shibboleth as one of their supported applications. You might want to look
>> at their solution.
>>
>> Best,
>>
>> Nadim El-Khoury
>> Director of Networks, Systems, Infrastructure, and Information Security
>> Officer
>> Springfield College
>> 263 Alden Street
>> Springfield, MA 01109
>> email: nel-khoury at springfield.edu
>>
>>
>>
>> On Fri, Jul 2, 2021 at 9:18 PM Nate Klingenstein <ndk at signet.id> wrote:
>>
>>> Nadim,
>>>
>>> I believe you could set up a flow that does that by presenting a page
>>> for username entry, then using a JavaScript comparison against a derived
>>> principal(or even the username as entered) in your MFA script as a
>>> conditional means to pick which flow to proceed to.  Part of the
>>> conditional flow example in the Wiki could help, but development of the
>>> complete set of flows and scripting will be a meaningful amount of work.
>>>
>>>
>>> https://wiki.shibboleth.net/confluence/display/IDP4/MultiFactorAuthnConfiguration
>>>
>>> However, I'm also curious how the 2FA/MFA solution works.  Usually, I
>>> hear 2FA defined as serial presentation of a combination of "something you
>>> know" and "something you have" and "something you intrinsically are", and
>>> MFA as simultaneous presentation of those.  It doesn't sound like
>>> "something you know" is a part of this, so I wonder what the two factors
>>> look like, given some of the challenges "something you intrinsically are"
>>> can present.
>>>
>>> https://en.wikipedia.org/wiki/Multi-factor_authentication
>>>
>>> Take care,
>>> Nate.
>>>
>>> --------
>>> Signet, Inc.
>>> The Art of Access ®
>>>
>>> https://www.signet.id
>>>
>>> -----Original message-----
>>> From: Nadim El-Khoury via users
>>> Sent: Saturday, July 3 2021, 1:00 am
>>> To: users at shibboleth.net
>>> Cc: Nadim El-Khoury
>>> Subject: Influence MFA authentication flow based on Username alone for
>>> phased 2FA deployment
>>>
>>> Hi Everyone,
>>>
>>> Is there a way to influence MFA authentication flow based on the
>>> Username alone?
>>>
>>> We want to phase the deployment of 2FA based on whether the user is part
>>> of phase1, phase2, and so forth. Our 2FA is passwordless and does not
>>> require the user to enter their username and password.
>>>
>>> So, we want only to display the Username field on the Login page. The
>>> user enters their username, and we determine whether to display the
>>> password field or send them to our 2FA passwordless SAML setup.
>>>
>>> I read most of the threads about MFA and went over the
>>> documentation, and there was one topic where the MFA flow was modified
>>> based on relying party.
>>>
>>> Best,
>>>
>>> Nadim El-Khoury
>>>
>>> Director of Networks, Systems, Infrastructure, and Information Security
>>> Officer
>>>
>>> Springfield College
>>>
>>> 263 Alden Street
>>>
>>> Springfield, MA 01109
>>>
>>> email: nel-khoury at springfield.edu <mailto:nel-khoury at springfield.edu>
>>>
>>> --
>>>
>>> For Consortium Member technical support, see
>>> https://wiki.shibboleth.net/confluence/x/coFAAg
>>>
>>> To unsubscribe from this list send an email to
>>> users-unsubscribe at shibboleth.net
>>>
>>>
>>>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210706/267d6ba4/attachment.htm>