robot access to SP website

[Alan Buxey]

hi,

> The admin of a website (using shib SP) asked me about this. They have a website that requires MFA. Right now, it always requires the MFA authnContext whenever anybody logs in.
>
>
>
> He wants to add a robot that will log in via cron job or something to run a report. The robot is not going to be able to answer the phone to MFA.


a robot could read SMS messages to get the value to proceed with MFA
but you want a different solution

>
> Is there an SP configuration he can use that will do something like: "if it's this specific robot logging in, it can use PasswordProtectedTransport...otherwise, everybody has to use MFA"? Or can you recommend some other solution to this kind of problem?
>
>
>
> I will ask if he can have the robot go in via an API or something instead of using SAML. But I want to see what the options are.


Programmatically Selecting Flows

look at that section on
https://wiki.shibboleth.net/confluence/display/IDP4/MultiFactorAuthnConfiguration
step 3 is your scenario. robot login is password only and that's good
enough, everyone else goes via MFA.

 alan