Influence MFA authentication flow based on Username alone for phased 2FA deployment

Tue Jul 6 18:34:08 UTC 2021

Nadim,

Yes my MFA flow does this:

1. First factor logic -> Do a lookup for something trusted that already contains the principal info or route to Password flow (this is purposefully vague)
2. Second factor logic -> Check if it's an app that can't do 2FA and if not then ask the web service if the user from #1 needs to see the 2FA flow (and also checks for other things that allow the user to skip the 2FA flow)

- Steve

From: Nadim El-Khoury <nel-khoury at springfield.edu>
Date: Tuesday, July 6, 2021 at 2:24 PM
To: Shib Users <users at shibboleth.net>, "Mak, Steve" <makst at upenn.edu>, Nate Klingenstein <ndk at signet.id>
Subject: Re: Influence MFA authentication flow based on Username alone for phased 2FA deployment

Hi Steve,

Thank you for sharing how you have configured your decision process on whether the user is required to fulfill the 2FA challenge. I am going to presume that the user is still required to enter their password first?

Best,

Nadim

On Tue, Jul 6, 2021 at 9:57 AM Nate Klingenstein <ndk at sudonym.me<mailto:ndk at sudonym.me>> wrote:
All neat stuff, Nadim and Steve.  Thanks for sharing.  As one of the greybeards in identity management at this point, it's exciting to see that people have found good ways to make biometrics work in practice.

I'll still have my old school concerns about the inability to reset one's biometrics, but with the capabilities of modern end user devices and protocols, I think those are minimized relative to the challenges of passwords or other credentials in many deployment scenarios, as ably demonstrated in Shilen's presentation and your explanations.

Again, thanks for passing all that along.

On Tue, Jul 6, 2021, 6:06 AM Mak, Steve <makst at upenn.edu<mailto:makst at upenn.edu>> wrote:
I wanted to add onto this discussion since it's related.

For our 2FA we did something using the custom script in the MFA flow. We have a web service that knows whether a user is required to fulfill the 2FA challenge. I just built a web client inside the script that talks to a local process using http and json that fetches that answer.

Then we route to the 2FA flow based on the return response.

The other route we had considered was using grouper entitlements to use an attribute to decide if a user needs to see the 2FA challenge, but we could never find a good solution regarding attribute sync delays.

The nice thing with the script and controlling the routing internally is we can control what happens when the web service goes down.

- Steve

From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> on behalf of Nadim El-Khoury via users <users at shibboleth.net<mailto:users at shibboleth.net>>
Reply-To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Tuesday, July 6, 2021 at 7:12 AM
To: Nate Klingenstein <ndk at signet.id<mailto:ndk at signet.id>>
Cc: Nadim El-Khoury <nel-khoury at springfield.edu<mailto:nel-khoury at springfield.edu>>, "users at shibboleth.net<mailto:users at shibboleth.net>" <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: Re: Influence MFA authentication flow based on Username alone for phased 2FA deployment

Hi Nate,

If you want to see how Trusona is currently integrated with our IDP instance.
You can go to the link below, type Springfield College, and be redirected to our IDP. You can click on the "Sign In using Trusona." The user is taken to Trusona and presented with a QR code. The user would have already registered their phone. Please note that the current setup is for testing, and I am still working on modifying the login page and the flow.
https://fedsp-stage.ccp.xcal.tv/auth?continue=https://fedsp-stage.ccp.xcal.tv/parseJWT&tenant=tester&usePing=true&xoc-school-i

Best,

Nadim

On Sun, Jul 4, 2021 at 9:32 AM Nadim El-Khoury <nel-khoury at springfield.edu<mailto:nel-khoury at springfield.edu>> wrote:
Hi Nate,

I am not sure how many are aware of it; Duke University developed its own internal Password-less solution called Duke Unlock.

https://meetings.internet2.edu/media/medialibrary/2019/12/05/20191210-patel-webauthn.pdf
https://www.incommon.org/news/duke-unlock-one-step-multi-factor/
https://oit.duke.edu/what-we-do/applications/duke-unlock

Best,

Nadim El-Khoury
Director of Networks, Systems, Infrastructure, and Information Security Officer
Springfield College
263 Alden Street
Springfield, MA 01109
email: nel-khoury at springfield.edu<mailto:nel-khoury at springfield.edu>

On Sun, Jul 4, 2021 at 8:50 AM Nadim El-Khoury <nel-khoury at springfield.edu<mailto:nel-khoury at springfield.edu>> wrote:
Hi Nate,

Thank you for the detailed information and steps. I will post back once I get the flow working.

We are going to use Trusona<https://www.trusona.com/why-trusona/passwordless-mfa> 2FA passwordless solution. In the beginning, they did not provide any integration with Shibboleth, but after talking to other universities and us, they added Shibboleth as one of their supported applications. You might want to look at their solution.

Best,

Nadim El-Khoury
Director of Networks, Systems, Infrastructure, and Information Security Officer
Springfield College
263 Alden Street
Springfield, MA 01109
email: nel-khoury at springfield.edu<mailto:nel-khoury at springfield.edu>

On Fri, Jul 2, 2021 at 9:18 PM Nate Klingenstein <ndk at signet.id<mailto:ndk at signet.id>> wrote:
Nadim,

I believe you could set up a flow that does that by presenting a page for username entry, then using a JavaScript comparison against a derived principal(or even the username as entered) in your MFA script as a conditional means to pick which flow to proceed to.  Part of the conditional flow example in the Wiki could help, but development of the complete set of flows and scripting will be a meaningful amount of work.

https://wiki.shibboleth.net/confluence/display/IDP4/MultiFactorAuthnConfiguration

However, I'm also curious how the 2FA/MFA solution works.  Usually, I hear 2FA defined as serial presentation of a combination of "something you know" and "something you have" and "something you intrinsically are", and MFA as simultaneous presentation of those.  It doesn't sound like "something you know" is a part of this, so I wonder what the two factors look like, given some of the challenges "something you intrinsically are" can present.

https://en.wikipedia.org/wiki/Multi-factor_authentication

Take care,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id

-----Original message-----
From: Nadim El-Khoury via users
Sent: Saturday, July 3 2021, 1:00 am
To: users at shibboleth.net<mailto:users at shibboleth.net>
Cc: Nadim El-Khoury
Subject: Influence MFA authentication flow based on Username alone for phased 2FA deployment

Hi Everyone,

Is there a way to influence MFA authentication flow based on the Username alone?

We want to phase the deployment of 2FA based on whether the user is part of phase1, phase2, and so forth. Our 2FA is passwordless and does not require the user to enter their username and password.

So, we want only to display the Username field on the Login page. The user enters their username, and we determine whether to display the password field or send them to our 2FA passwordless SAML setup.

I read most of the threads about MFA and went over the documentation, and there was one topic where the MFA flow was modified based on relying party.

Best,

Nadim El-Khoury

Director of Networks, Systems, Infrastructure, and Information Security Officer

Springfield College

263 Alden Street

Springfield, MA 01109

email: nel-khoury at springfield.edu<mailto:nel-khoury at springfield.edu> <mailto:nel-khoury at springfield.edu<mailto:nel-khoury at springfield.edu>>

--

For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210706/2c8f9298/attachment.htm>