Influence MFA authentication flow based on Username alone for phased 2FA deployment

Wed Jul 7 12:08:56 UTC 2021

Hi Steve, Scott,

Thank you for the added information, directions, and what to look for to
make sure that the flow works.

Best,

Nadim El-Khoury

Director of Networks, Systems, Infrastructure, and Information Security
Officer

Springfield College

263 Alden Street

Springfield, MA 01109

email: nel-khoury at springfield.edu

On Tue, Jul 6, 2021 at 2:34 PM Mak, Steve <makst at upenn.edu> wrote:

> Nadim,
>
>
>
> Yes my MFA flow does this:
>
> 1. First factor logic -> Do a lookup for something trusted that already
> contains the principal info or route to Password flow (this is purposefully
> vague)
>
> 2. Second factor logic -> Check if it's an app that can't do 2FA and if
> not then ask the web service if the user from #1 needs to see the 2FA flow
> (and also checks for other things that allow the user to skip the 2FA flow)
>
>
>
> - Steve
>
>
>
> *From: *Nadim El-Khoury <nel-khoury at springfield.edu>
> *Date: *Tuesday, July 6, 2021 at 2:24 PM
> *To: *Shib Users <users at shibboleth.net>, "Mak, Steve" <makst at upenn.edu>,
> Nate Klingenstein <ndk at signet.id>
> *Subject: *Re: Influence MFA authentication flow based on Username alone
> for phased 2FA deployment
>
>
>
> Hi Steve,
>
>
>
> Thank you for sharing how you have configured your decision process on
> whether the user is required to fulfill the 2FA challenge. I am going to
> presume that the user is still required to enter their password first?
>
>
>
> Best,
>
>
> Nadim
>
>
>
> On Tue, Jul 6, 2021 at 9:57 AM Nate Klingenstein <ndk at sudonym.me> wrote:
>
> All neat stuff, Nadim and Steve.  Thanks for sharing.  As one of the
> greybeards in identity management at this point, it's exciting to see that
> people have found good ways to make biometrics work in practice.
>
>
>
> I'll still have my old school concerns about the inability to reset one's
> biometrics, but with the capabilities of modern end user devices and
> protocols, I think those are minimized relative to the challenges of
> passwords or other credentials in many deployment scenarios, as ably
> demonstrated in Shilen's presentation and your explanations.
>
>
>
> Again, thanks for passing all that along.
>
>
>
> On Tue, Jul 6, 2021, 6:06 AM Mak, Steve <makst at upenn.edu> wrote:
>
> I wanted to add onto this discussion since it's related.
>
> For our 2FA we did something using the custom script in the MFA flow. We
> have a web service that knows whether a user is required to fulfill the 2FA
> challenge. I just built a web client inside the script that talks to a
> local process using http and json that fetches that answer.
>
>
>
> Then we route to the 2FA flow based on the return response.
>
>
>
> The other route we had considered was using grouper entitlements to use an
> attribute to decide if a user needs to see the 2FA challenge, but we could
> never find a good solution regarding attribute sync delays.
>
>
>
> The nice thing with the script and controlling the routing internally is
> we can control what happens when the web service goes down.
>
>
>
> - Steve
>
>
>
> *From: *users <users-bounces at shibboleth.net> on behalf of Nadim El-Khoury
> via users <users at shibboleth.net>
> *Reply-To: *Shib Users <users at shibboleth.net>
> *Date: *Tuesday, July 6, 2021 at 7:12 AM
> *To: *Nate Klingenstein <ndk at signet.id>
> *Cc: *Nadim El-Khoury <nel-khoury at springfield.edu>, "users at shibboleth.net"
> <users at shibboleth.net>
> *Subject: *Re: Influence MFA authentication flow based on Username alone
> for phased 2FA deployment
>
>
>
> Hi Nate,
>
>
>
> If you want to see how Trusona is currently integrated with our IDP
> instance.
>
> You can go to the link below, type Springfield College, and be redirected
> to our IDP. You can click on the "Sign In using Trusona." The user is taken
> to Trusona and presented with a QR code. The user would have
> already registered their phone. Please note that the current setup is for
> testing, and I am still working on modifying the login page and the flow.
>
>
> https://fedsp-stage.ccp.xcal.tv/auth?continue=https://fedsp-stage.ccp.xcal.tv/parseJWT&tenant=tester&usePing=true&xoc-school-i
>
>
>
> Best,
>
>
>
> Nadim
>
>
>
> On Sun, Jul 4, 2021 at 9:32 AM Nadim El-Khoury <nel-khoury at springfield.edu>
> wrote:
>
> Hi Nate,
>
>
>
> I am not sure how many are aware of it; Duke University developed its own
> internal Password-less solution called Duke Unlock.
>
>
>
>
> https://meetings.internet2.edu/media/medialibrary/2019/12/05/20191210-patel-webauthn.pdf
>
> https://www.incommon.org/news/duke-unlock-one-step-multi-factor/
>
> https://oit.duke.edu/what-we-do/applications/duke-unlock
>
>
>
> Best,
>
>
>
> Nadim El-Khoury
>
> Director of Networks, Systems, Infrastructure, and Information Security
> Officer
>
> Springfield College
>
> 263 Alden Street
>
> Springfield, MA 01109
>
> email: nel-khoury at springfield.edu
>
>
>
> On Sun, Jul 4, 2021 at 8:50 AM Nadim El-Khoury <nel-khoury at springfield.edu>
> wrote:
>
> Hi Nate,
>
>
>
> Thank you for the detailed information and steps. I will post back once I
> get the flow working.
>
>
>
> We are going to use Trusona
> <https://www.trusona.com/why-trusona/passwordless-mfa> 2FA passwordless
> solution. In the beginning, they did not provide any integration with
> Shibboleth, but after talking to other universities and us, they added
> Shibboleth as one of their supported applications. You might want to look
> at their solution.
>
>
>
> Best,
>
>
>
> Nadim El-Khoury
>
> Director of Networks, Systems, Infrastructure, and Information Security
> Officer
>
> Springfield College
>
> 263 Alden Street
>
> Springfield, MA 01109
>
> email: nel-khoury at springfield.edu
>
>
>
>
>
>
>
> On Fri, Jul 2, 2021 at 9:18 PM Nate Klingenstein <ndk at signet.id> wrote:
>
> Nadim,
>
> I believe you could set up a flow that does that by presenting a page for
> username entry, then using a JavaScript comparison against a derived
> principal(or even the username as entered) in your MFA script as a
> conditional means to pick which flow to proceed to.  Part of the
> conditional flow example in the Wiki could help, but development of the
> complete set of flows and scripting will be a meaningful amount of work.
>
>
> https://wiki.shibboleth.net/confluence/display/IDP4/MultiFactorAuthnConfiguration
>
> However, I'm also curious how the 2FA/MFA solution works.  Usually, I hear
> 2FA defined as serial presentation of a combination of "something you know"
> and "something you have" and "something you intrinsically are", and MFA as
> simultaneous presentation of those.  It doesn't sound like "something you
> know" is a part of this, so I wonder what the two factors look like, given
> some of the challenges "something you intrinsically are" can present.
>
> https://en.wikipedia.org/wiki/Multi-factor_authentication
>
> Take care,
> Nate.
>
> --------
> Signet, Inc.
> The Art of Access ®
>
> https://www.signet.id
>
> -----Original message-----
> From: Nadim El-Khoury via users
> Sent: Saturday, July 3 2021, 1:00 am
> To: users at shibboleth.net
> Cc: Nadim El-Khoury
> Subject: Influence MFA authentication flow based on Username alone for
> phased 2FA deployment
>
> Hi Everyone,
>
> Is there a way to influence MFA authentication flow based on the Username
> alone?
>
> We want to phase the deployment of 2FA based on whether the user is part
> of phase1, phase2, and so forth. Our 2FA is passwordless and does not
> require the user to enter their username and password.
>
> So, we want only to display the Username field on the Login page. The user
> enters their username, and we determine whether to display the password
> field or send them to our 2FA passwordless SAML setup.
>
> I read most of the threads about MFA and went over the documentation, and
> there was one topic where the MFA flow was modified based on relying party.
>
> Best,
>
> Nadim El-Khoury
>
> Director of Networks, Systems, Infrastructure, and Information Security
> Officer
>
> Springfield College
>
> 263 Alden Street
>
> Springfield, MA 01109
>
> email: nel-khoury at springfield.edu <mailto:nel-khoury at springfield.edu>
>
> --
>
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
>
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210707/3a79e148/attachment.htm>