Influence MFA authentication flow based on Username alone for phased 2FA deployment

Tue Jul 6 13:57:32 UTC 2021

All neat stuff, Nadim and Steve.  Thanks for sharing.  As one of the
greybeards in identity management at this point, it's exciting to see that
people have found good ways to make biometrics work in practice.

I'll still have my old school concerns about the inability to reset one's
biometrics, but with the capabilities of modern end user devices and
protocols, I think those are minimized relative to the challenges of
passwords or other credentials in many deployment scenarios, as ably
demonstrated in Shilen's presentation and your explanations.

Again, thanks for passing all that along.

On Tue, Jul 6, 2021, 6:06 AM Mak, Steve <makst at upenn.edu> wrote:

> I wanted to add onto this discussion since it's related.
>
> For our 2FA we did something using the custom script in the MFA flow. We
> have a web service that knows whether a user is required to fulfill the 2FA
> challenge. I just built a web client inside the script that talks to a
> local process using http and json that fetches that answer.
>
>
>
> Then we route to the 2FA flow based on the return response.
>
>
>
> The other route we had considered was using grouper entitlements to use an
> attribute to decide if a user needs to see the 2FA challenge, but we could
> never find a good solution regarding attribute sync delays.
>
>
>
> The nice thing with the script and controlling the routing internally is
> we can control what happens when the web service goes down.
>
>
>
> - Steve
>
>
>
> *From: *users <users-bounces at shibboleth.net> on behalf of Nadim El-Khoury
> via users <users at shibboleth.net>
> *Reply-To: *Shib Users <users at shibboleth.net>
> *Date: *Tuesday, July 6, 2021 at 7:12 AM
> *To: *Nate Klingenstein <ndk at signet.id>
> *Cc: *Nadim El-Khoury <nel-khoury at springfield.edu>, "users at shibboleth.net"
> <users at shibboleth.net>
> *Subject: *Re: Influence MFA authentication flow based on Username alone
> for phased 2FA deployment
>
>
>
> Hi Nate,
>
>
>
> If you want to see how Trusona is currently integrated with our IDP
> instance.
>
> You can go to the link below, type Springfield College, and be redirected
> to our IDP. You can click on the "Sign In using Trusona." The user is taken
> to Trusona and presented with a QR code. The user would have
> already registered their phone. Please note that the current setup is for
> testing, and I am still working on modifying the login page and the flow.
>
>
> https://fedsp-stage.ccp.xcal.tv/auth?continue=https://fedsp-stage.ccp.xcal.tv/parseJWT&tenant=tester&usePing=true&xoc-school-i
>
>
>
> Best,
>
>
>
> Nadim
>
>
>
> On Sun, Jul 4, 2021 at 9:32 AM Nadim El-Khoury <nel-khoury at springfield.edu>
> wrote:
>
> Hi Nate,
>
>
>
> I am not sure how many are aware of it; Duke University developed its own
> internal Password-less solution called Duke Unlock.
>
>
>
>
> https://meetings.internet2.edu/media/medialibrary/2019/12/05/20191210-patel-webauthn.pdf
>
> https://www.incommon.org/news/duke-unlock-one-step-multi-factor/
>
> https://oit.duke.edu/what-we-do/applications/duke-unlock
>
>
>
> Best,
>
>
>
> Nadim El-Khoury
>
> Director of Networks, Systems, Infrastructure, and Information Security
> Officer
>
> Springfield College
>
> 263 Alden Street
>
> Springfield, MA 01109
>
> email: nel-khoury at springfield.edu
>
>
>
> On Sun, Jul 4, 2021 at 8:50 AM Nadim El-Khoury <nel-khoury at springfield.edu>
> wrote:
>
> Hi Nate,
>
>
>
> Thank you for the detailed information and steps. I will post back once I
> get the flow working.
>
>
>
> We are going to use Trusona
> <https://www.trusona.com/why-trusona/passwordless-mfa> 2FA passwordless
> solution. In the beginning, they did not provide any integration with
> Shibboleth, but after talking to other universities and us, they added
> Shibboleth as one of their supported applications. You might want to look
> at their solution.
>
>
>
> Best,
>
>
>
> Nadim El-Khoury
>
> Director of Networks, Systems, Infrastructure, and Information Security
> Officer
>
> Springfield College
>
> 263 Alden Street
>
> Springfield, MA 01109
>
> email: nel-khoury at springfield.edu
>
>
>
>
>
>
>
> On Fri, Jul 2, 2021 at 9:18 PM Nate Klingenstein <ndk at signet.id> wrote:
>
> Nadim,
>
> I believe you could set up a flow that does that by presenting a page for
> username entry, then using a JavaScript comparison against a derived
> principal(or even the username as entered) in your MFA script as a
> conditional means to pick which flow to proceed to.  Part of the
> conditional flow example in the Wiki could help, but development of the
> complete set of flows and scripting will be a meaningful amount of work.
>
>
> https://wiki.shibboleth.net/confluence/display/IDP4/MultiFactorAuthnConfiguration
>
> However, I'm also curious how the 2FA/MFA solution works.  Usually, I hear
> 2FA defined as serial presentation of a combination of "something you know"
> and "something you have" and "something you intrinsically are", and MFA as
> simultaneous presentation of those.  It doesn't sound like "something you
> know" is a part of this, so I wonder what the two factors look like, given
> some of the challenges "something you intrinsically are" can present.
>
> https://en.wikipedia.org/wiki/Multi-factor_authentication
>
> Take care,
> Nate.
>
> --------
> Signet, Inc.
> The Art of Access ®
>
> https://www.signet.id
>
> -----Original message-----
> From: Nadim El-Khoury via users
> Sent: Saturday, July 3 2021, 1:00 am
> To: users at shibboleth.net
> Cc: Nadim El-Khoury
> Subject: Influence MFA authentication flow based on Username alone for
> phased 2FA deployment
>
> Hi Everyone,
>
> Is there a way to influence MFA authentication flow based on the Username
> alone?
>
> We want to phase the deployment of 2FA based on whether the user is part
> of phase1, phase2, and so forth. Our 2FA is passwordless and does not
> require the user to enter their username and password.
>
> So, we want only to display the Username field on the Login page. The user
> enters their username, and we determine whether to display the password
> field or send them to our 2FA passwordless SAML setup.
>
> I read most of the threads about MFA and went over the documentation, and
> there was one topic where the MFA flow was modified based on relying party.
>
> Best,
>
> Nadim El-Khoury
>
> Director of Networks, Systems, Infrastructure, and Information Security
> Officer
>
> Springfield College
>
> 263 Alden Street
>
> Springfield, MA 01109
>
> email: nel-khoury at springfield.edu <mailto:nel-khoury at springfield.edu>
>
> --
>
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
>
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210706/16551194/attachment.htm>