Influence MFA authentication flow based on Username alone for phased 2FA deployment

Wed Jul 7 12:55:47 UTC 2021

Hi

This is a question for IT or the advanced practioners please

From: users <users-bounces at shibboleth.net> On Behalf Of Nadim El-Khoury via users
Sent: 07 July 2021 13:09
To: Mak, Steve <makst at upenn.edu>; cantor.2 at osu.edu
Cc: Nadim El-Khoury <nel-khoury at springfield.edu>; Shib Users <users at shibboleth.net>
Subject: Re: Influence MFA authentication flow based on Username alone for phased 2FA deployment

[WARNING] This e-mail has been sent to you from outside of MidKent College. Do not click links or open attachments unless you know the sender and are expecting the content.

Hi Steve, Scott,

Thank you for the added information, directions, and what to look for to make sure that the flow works.

Best,

Nadim El-Khoury
Director of Networks, Systems, Infrastructure, and Information Security Officer
Springfield College
263 Alden Street
Springfield, MA 01109
email: nel-khoury at springfield.edu<mailto:nel-khoury at springfield.edu>

Dan Attwood 
BI Reporting Sys Man 
  Main: +441634383000        
Direct: +441634383483 
Web: www.midkent.ac.uk 
Disclaimer: MidKent College accepts no responsibility for information, errors or omissions in this e-mail and any files transmitted with it, nor for its use or misuse, nor for any act committed or omitted in connection with this communication. If in doubt, please verify the authenticity of the contents with the sender. It is the recipient's responsibility to ensure that appropriate measures are in place to check for software viruses.
Confidentiality: This e-mail (including any attachments) is intended only for the recipient(s) named above. It may contain confidential or privileged information and should not be read, copied or otherwise used by any other person unless express permission is given. If you are not a named recipient, please contact the sender and delete the email from your system. It is important that you should not disclose its contents to any other person or copy it for your own or others uses.
On Tue, Jul 6, 2021 at 2:34 PM Mak, Steve <makst at upenn.edu<mailto:makst at upenn.edu>> wrote:
Nadim,

Yes my MFA flow does this:

1. First factor logic -> Do a lookup for something trusted that already contains the principal info or route to Password flow (this is purposefully vague)
2. Second factor logic -> Check if it's an app that can't do 2FA and if not then ask the web service if the user from #1 needs to see the 2FA flow (and also checks for other things that allow the user to skip the 2FA flow)

- Steve

From: Nadim El-Khoury <nel-khoury at springfield.edu<mailto:nel-khoury at springfield.edu>>
Date: Tuesday, July 6, 2021 at 2:24 PM
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>, "Mak, Steve" <makst at upenn.edu<mailto:makst at upenn.edu>>, Nate Klingenstein <ndk at signet.id<mailto:ndk at signet.id>>
Subject: Re: Influence MFA authentication flow based on Username alone for phased 2FA deployment

Hi Steve,

Thank you for sharing how you have configured your decision process on whether the user is required to fulfill the 2FA challenge. I am going to presume that the user is still required to enter their password first?

Best,

Nadim

On Tue, Jul 6, 2021 at 9:57 AM Nate Klingenstein <ndk at sudonym.me<mailto:ndk at sudonym.me>> wrote:
All neat stuff, Nadim and Steve.  Thanks for sharing.  As one of the greybeards in identity management at this point, it's exciting to see that people have found good ways to make biometrics work in practice.

I'll still have my old school concerns about the inability to reset one's biometrics, but with the capabilities of modern end user devices and protocols, I think those are minimized relative to the challenges of passwords or other credentials in many deployment scenarios, as ably demonstrated in Shilen's presentation and your explanations.

Again, thanks for passing all that along.

On Tue, Jul 6, 2021, 6:06 AM Mak, Steve <makst at upenn.edu<mailto:makst at upenn.edu>> wrote:
I wanted to add onto this discussion since it's related.

For our 2FA we did something using the custom script in the MFA flow. We have a web service that knows whether a user is required to fulfill the 2FA challenge. I just built a web client inside the script that talks to a local process using http and json that fetches that answer.

Then we route to the 2FA flow based on the return response.

The other route we had considered was using grouper entitlements to use an attribute to decide if a user needs to see the 2FA challenge, but we could never find a good solution regarding attribute sync delays.

The nice thing with the script and controlling the routing internally is we can control what happens when the web service goes down.

- Steve

From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> on behalf of Nadim El-Khoury via users <users at shibboleth.net<mailto:users at shibboleth.net>>
Reply-To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Tuesday, July 6, 2021 at 7:12 AM
To: Nate Klingenstein <ndk at signet.id<mailto:ndk at signet.id>>
Cc: Nadim El-Khoury <nel-khoury at springfield.edu<mailto:nel-khoury at springfield.edu>>, "users at shibboleth.net<mailto:users at shibboleth.net>" <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: Re: Influence MFA authentication flow based on Username alone for phased 2FA deployment

Hi Nate,

If you want to see how Trusona is currently integrated with our IDP instance.
You can go to the link below, type Springfield College, and be redirected to our IDP. You can click on the "Sign In using Trusona." The user is taken to Trusona and presented with a QR code. The user would have already registered their phone. Please note that the current setup is for testing, and I am still working on modifying the login page and the flow.
https://fedsp-stage.ccp.xcal.tv/auth?continue=https://fedsp-stage.ccp.xcal.tv/parseJWT&tenant=tester&usePing=true&xoc-school-i<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Ffedsp-stage.ccp.xcal.tv%2Fauth%3Fcontinue%3Dhttps%3A%2F%2Ffedsp-stage.ccp.xcal.tv%2FparseJWT%26tenant%3Dtester%26usePing%3Dtrue%26xoc-school-i&data=04%7C01%7Cdan.attwood%40midkent.ac.uk%7Cd4713c060d084f95ca9208d941401ea6%7C157678f9b5f84952af3282449dc16f58%7C0%7C0%7C637612565919669168%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=XsrmD2gXxu1BV%2FqxLLzZN7m%2BUXkOCc56OTuCATzvepk%3D&reserved=0>

Best,

Nadim

On Sun, Jul 4, 2021 at 9:32 AM Nadim El-Khoury <nel-khoury at springfield.edu<mailto:nel-khoury at springfield.edu>> wrote:
Hi Nate,

I am not sure how many are aware of it; Duke University developed its own internal Password-less solution called Duke Unlock.

https://meetings.internet2.edu/media/medialibrary/2019/12/05/20191210-patel-webauthn.pdf<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fmeetings.internet2.edu%2Fmedia%2Fmedialibrary%2F2019%2F12%2F05%2F20191210-patel-webauthn.pdf&data=04%7C01%7Cdan.attwood%40midkent.ac.uk%7Cd4713c060d084f95ca9208d941401ea6%7C157678f9b5f84952af3282449dc16f58%7C0%7C0%7C637612565919679106%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=kcRd6oo7u1D9pSH6SXOWXy4%2BmjWjR3Irjktc7q%2F8GD8%3D&reserved=0>
https://www.incommon.org/news/duke-unlock-one-step-multi-factor/<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.incommon.org%2Fnews%2Fduke-unlock-one-step-multi-factor%2F&data=04%7C01%7Cdan.attwood%40midkent.ac.uk%7Cd4713c060d084f95ca9208d941401ea6%7C157678f9b5f84952af3282449dc16f58%7C0%7C0%7C637612565919679106%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=Vk8AML0cFr6STbWzs4kPL6OQJvPiq6rxPFWGnytRNII%3D&reserved=0>
https://oit.duke.edu/what-we-do/applications/duke-unlock<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Foit.duke.edu%2Fwhat-we-do%2Fapplications%2Fduke-unlock&data=04%7C01%7Cdan.attwood%40midkent.ac.uk%7Cd4713c060d084f95ca9208d941401ea6%7C157678f9b5f84952af3282449dc16f58%7C0%7C0%7C637612565919689062%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=BLMMr3Ipf4WkW4mb%2B95qKiYXZ0QE9PTlSLJWlH4vjtE%3D&reserved=0>

Best,

Nadim El-Khoury
Director of Networks, Systems, Infrastructure, and Information Security Officer
Springfield College
263 Alden Street
Springfield, MA 01109
email: nel-khoury at springfield.edu<mailto:nel-khoury at springfield.edu>

On Sun, Jul 4, 2021 at 8:50 AM Nadim El-Khoury <nel-khoury at springfield.edu<mailto:nel-khoury at springfield.edu>> wrote:
Hi Nate,

Thank you for the detailed information and steps. I will post back once I get the flow working.

We are going to use Trusona<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.trusona.com%2Fwhy-trusona%2Fpasswordless-mfa&data=04%7C01%7Cdan.attwood%40midkent.ac.uk%7Cd4713c060d084f95ca9208d941401ea6%7C157678f9b5f84952af3282449dc16f58%7C0%7C0%7C637612565919689062%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=w5JWC67MWa7nROhUScT02vc%2B4RNht6jRv975zBIdgtw%3D&reserved=0> 2FA passwordless solution. In the beginning, they did not provide any integration with Shibboleth, but after talking to other universities and us, they added Shibboleth as one of their supported applications. You might want to look at their solution.

Best,

Nadim El-Khoury
Director of Networks, Systems, Infrastructure, and Information Security Officer
Springfield College
263 Alden Street
Springfield, MA 01109
email: nel-khoury at springfield.edu<mailto:nel-khoury at springfield.edu>

On Fri, Jul 2, 2021 at 9:18 PM Nate Klingenstein <ndk at signet.id<mailto:ndk at signet.id>> wrote:
Nadim,

I believe you could set up a flow that does that by presenting a page for username entry, then using a JavaScript comparison against a derived principal(or even the username as entered) in your MFA script as a conditional means to pick which flow to proceed to.  Part of the conditional flow example in the Wiki could help, but development of the complete set of flows and scripting will be a meaningful amount of work.

https://wiki.shibboleth.net/confluence/display/IDP4/MultiFactorAuthnConfiguration<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fdisplay%2FIDP4%2FMultiFactorAuthnConfiguration&data=04%7C01%7Cdan.attwood%40midkent.ac.uk%7Cd4713c060d084f95ca9208d941401ea6%7C157678f9b5f84952af3282449dc16f58%7C0%7C0%7C637612565919699017%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=%2FtPkI3lqkV1aLaEVYxIUJ84C0ZVg9CugKQk7u4QbRsA%3D&reserved=0>

However, I'm also curious how the 2FA/MFA solution works.  Usually, I hear 2FA defined as serial presentation of a combination of "something you know" and "something you have" and "something you intrinsically are", and MFA as simultaneous presentation of those.  It doesn't sound like "something you know" is a part of this, so I wonder what the two factors look like, given some of the challenges "something you intrinsically are" can present.

https://en.wikipedia.org/wiki/Multi-factor_authentication<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FMulti-factor_authentication&data=04%7C01%7Cdan.attwood%40midkent.ac.uk%7Cd4713c060d084f95ca9208d941401ea6%7C157678f9b5f84952af3282449dc16f58%7C0%7C0%7C637612565919699017%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=B3KWHiBHVNs5dyi4MPFJn7bU6zB0dplw5QwRqN3C3aU%3D&reserved=0>

Take care,
Nate.

--------
Signet, Inc.
The Art of Access (r)

https://www.signet.id<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwww.signet.id%2F&data=04%7C01%7Cdan.attwood%40midkent.ac.uk%7Cd4713c060d084f95ca9208d941401ea6%7C157678f9b5f84952af3282449dc16f58%7C0%7C0%7C637612565919708973%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=aEWLYdhtmmabcz2CDTT3j2LbdH5WSeTN3BHMjOzXlzs%3D&reserved=0>

-----Original message-----
From: Nadim El-Khoury via users
Sent: Saturday, July 3 2021, 1:00 am
To: users at shibboleth.net<mailto:users at shibboleth.net>
Cc: Nadim El-Khoury
Subject: Influence MFA authentication flow based on Username alone for phased 2FA deployment

Hi Everyone,

Is there a way to influence MFA authentication flow based on the Username alone?

We want to phase the deployment of 2FA based on whether the user is part of phase1, phase2, and so forth. Our 2FA is passwordless and does not require the user to enter their username and password.

So, we want only to display the Username field on the Login page. The user enters their username, and we determine whether to display the password field or send them to our 2FA passwordless SAML setup.

I read most of the threads about MFA and went over the documentation, and there was one topic where the MFA flow was modified based on relying party.

Best,

Nadim El-Khoury

Director of Networks, Systems, Infrastructure, and Information Security Officer

Springfield College

263 Alden Street

Springfield, MA 01109

email: nel-khoury at springfield.edu<mailto:nel-khoury at springfield.edu> <mailto:nel-khoury at springfield.edu<mailto:nel-khoury at springfield.edu>>

--

For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Cdan.attwood%40midkent.ac.uk%7Cd4713c060d084f95ca9208d941401ea6%7C157678f9b5f84952af3282449dc16f58%7C0%7C0%7C637612565919708973%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=S6UojHDeAbiNoL7sdDaZXx76jmgvArX6EKqWSMTgLgg%3D&reserved=0>

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Cdan.attwood%40midkent.ac.uk%7Cd4713c060d084f95ca9208d941401ea6%7C157678f9b5f84952af3282449dc16f58%7C0%7C0%7C637612565919718942%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=YYO0WbV3iDzZnjqU2T01Sh9kChNCnL%2FkeMm1Q3QwlPU%3D&reserved=0>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg<https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Cdan.attwood%40midkent.ac.uk%7Cd4713c060d084f95ca9208d941401ea6%7C157678f9b5f84952af3282449dc16f58%7C0%7C0%7C637612565919718942%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=YYO0WbV3iDzZnjqU2T01Sh9kChNCnL%2FkeMm1Q3QwlPU%3D&reserved=0>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210707/a6f9f32f/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 1786 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20210707/a6f9f32f/attachment.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: image/png
Size: 2045 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20210707/a6f9f32f/attachment-0001.png>