Influence MFA authentication flow based on Username alone for phased 2FA deployment

Tue Jul 6 18:24:03 UTC 2021

Hi Steve,

Thank you for sharing how you have configured your decision process on
whether the user is required to fulfill the 2FA challenge. I am going to
presume that the user is still required to enter their password first?

Best,

Nadim

On Tue, Jul 6, 2021 at 9:57 AM Nate Klingenstein <ndk at sudonym.me> wrote:

> All neat stuff, Nadim and Steve.  Thanks for sharing.  As one of the
> greybeards in identity management at this point, it's exciting to see that
> people have found good ways to make biometrics work in practice.
>
> I'll still have my old school concerns about the inability to reset one's
> biometrics, but with the capabilities of modern end user devices and
> protocols, I think those are minimized relative to the challenges of
> passwords or other credentials in many deployment scenarios, as ably
> demonstrated in Shilen's presentation and your explanations.
>
> Again, thanks for passing all that along.
>
> On Tue, Jul 6, 2021, 6:06 AM Mak, Steve <makst at upenn.edu> wrote:
>
>> I wanted to add onto this discussion since it's related.
>>
>> For our 2FA we did something using the custom script in the MFA flow. We
>> have a web service that knows whether a user is required to fulfill the 2FA
>> challenge. I just built a web client inside the script that talks to a
>> local process using http and json that fetches that answer.
>>
>>
>>
>> Then we route to the 2FA flow based on the return response.
>>
>>
>>
>> The other route we had considered was using grouper entitlements to use
>> an attribute to decide if a user needs to see the 2FA challenge, but we
>> could never find a good solution regarding attribute sync delays.
>>
>>
>>
>> The nice thing with the script and controlling the routing internally is
>> we can control what happens when the web service goes down.
>>
>>
>>
>> - Steve
>>
>>
>>
>> *From: *users <users-bounces at shibboleth.net> on behalf of Nadim
>> El-Khoury via users <users at shibboleth.net>
>> *Reply-To: *Shib Users <users at shibboleth.net>
>> *Date: *Tuesday, July 6, 2021 at 7:12 AM
>> *To: *Nate Klingenstein <ndk at signet.id>
>> *Cc: *Nadim El-Khoury <nel-khoury at springfield.edu>, "users at shibboleth.net"
>> <users at shibboleth.net>
>> *Subject: *Re: Influence MFA authentication flow based on Username alone
>> for phased 2FA deployment
>>
>>
>>
>> Hi Nate,
>>
>>
>>
>> If you want to see how Trusona is currently integrated with our IDP
>> instance.
>>
>> You can go to the link below, type Springfield College, and be redirected
>> to our IDP. You can click on the "Sign In using Trusona." The user is taken
>> to Trusona and presented with a QR code. The user would have
>> already registered their phone. Please note that the current setup is for
>> testing, and I am still working on modifying the login page and the flow.
>>
>>
>> https://fedsp-stage.ccp.xcal.tv/auth?continue=https://fedsp-stage.ccp.xcal.tv/parseJWT&tenant=tester&usePing=true&xoc-school-i
>>
>>
>>
>> Best,
>>
>>
>>
>> Nadim
>>
>>
>>
>> On Sun, Jul 4, 2021 at 9:32 AM Nadim El-Khoury <
>> nel-khoury at springfield.edu> wrote:
>>
>> Hi Nate,
>>
>>
>>
>> I am not sure how many are aware of it; Duke University developed its own
>> internal Password-less solution called Duke Unlock.
>>
>>
>>
>>
>> https://meetings.internet2.edu/media/medialibrary/2019/12/05/20191210-patel-webauthn.pdf
>>
>> https://www.incommon.org/news/duke-unlock-one-step-multi-factor/
>>
>> https://oit.duke.edu/what-we-do/applications/duke-unlock
>>
>>
>>
>> Best,
>>
>>
>>
>> Nadim El-Khoury
>>
>> Director of Networks, Systems, Infrastructure, and Information Security
>> Officer
>>
>> Springfield College
>>
>> 263 Alden Street
>>
>> Springfield, MA 01109
>>
>> email: nel-khoury at springfield.edu
>>
>>
>>
>> On Sun, Jul 4, 2021 at 8:50 AM Nadim El-Khoury <
>> nel-khoury at springfield.edu> wrote:
>>
>> Hi Nate,
>>
>>
>>
>> Thank you for the detailed information and steps. I will post back once I
>> get the flow working.
>>
>>
>>
>> We are going to use Trusona
>> <https://www.trusona.com/why-trusona/passwordless-mfa> 2FA passwordless
>> solution. In the beginning, they did not provide any integration with
>> Shibboleth, but after talking to other universities and us, they added
>> Shibboleth as one of their supported applications. You might want to look
>> at their solution.
>>
>>
>>
>> Best,
>>
>>
>>
>> Nadim El-Khoury
>>
>> Director of Networks, Systems, Infrastructure, and Information Security
>> Officer
>>
>> Springfield College
>>
>> 263 Alden Street
>>
>> Springfield, MA 01109
>>
>> email: nel-khoury at springfield.edu
>>
>>
>>
>>
>>
>>
>>
>> On Fri, Jul 2, 2021 at 9:18 PM Nate Klingenstein <ndk at signet.id> wrote:
>>
>> Nadim,
>>
>> I believe you could set up a flow that does that by presenting a page for
>> username entry, then using a JavaScript comparison against a derived
>> principal(or even the username as entered) in your MFA script as a
>> conditional means to pick which flow to proceed to.  Part of the
>> conditional flow example in the Wiki could help, but development of the
>> complete set of flows and scripting will be a meaningful amount of work.
>>
>>
>> https://wiki.shibboleth.net/confluence/display/IDP4/MultiFactorAuthnConfiguration
>>
>> However, I'm also curious how the 2FA/MFA solution works.  Usually, I
>> hear 2FA defined as serial presentation of a combination of "something you
>> know" and "something you have" and "something you intrinsically are", and
>> MFA as simultaneous presentation of those.  It doesn't sound like
>> "something you know" is a part of this, so I wonder what the two factors
>> look like, given some of the challenges "something you intrinsically are"
>> can present.
>>
>> https://en.wikipedia.org/wiki/Multi-factor_authentication
>>
>> Take care,
>> Nate.
>>
>> --------
>> Signet, Inc.
>> The Art of Access ®
>>
>> https://www.signet.id
>>
>> -----Original message-----
>> From: Nadim El-Khoury via users
>> Sent: Saturday, July 3 2021, 1:00 am
>> To: users at shibboleth.net
>> Cc: Nadim El-Khoury
>> Subject: Influence MFA authentication flow based on Username alone for
>> phased 2FA deployment
>>
>> Hi Everyone,
>>
>> Is there a way to influence MFA authentication flow based on the Username
>> alone?
>>
>> We want to phase the deployment of 2FA based on whether the user is part
>> of phase1, phase2, and so forth. Our 2FA is passwordless and does not
>> require the user to enter their username and password.
>>
>> So, we want only to display the Username field on the Login page. The
>> user enters their username, and we determine whether to display the
>> password field or send them to our 2FA passwordless SAML setup.
>>
>> I read most of the threads about MFA and went over the documentation, and
>> there was one topic where the MFA flow was modified based on relying party.
>>
>> Best,
>>
>> Nadim El-Khoury
>>
>> Director of Networks, Systems, Infrastructure, and Information Security
>> Officer
>>
>> Springfield College
>>
>> 263 Alden Street
>>
>> Springfield, MA 01109
>>
>> email: nel-khoury at springfield.edu <mailto:nel-khoury at springfield.edu>
>>
>> --
>>
>> For Consortium Member technical support, see
>> https://wiki.shibboleth.net/confluence/x/coFAAg
>>
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>> --
>> For Consortium Member technical support, see
>> https://wiki.shibboleth.net/confluence/x/coFAAg
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210706/0543c29c/attachment.htm>