forced Authentication with authn/External

[Cantor, Scott]

> Is it as simple as adding idp.authn.external.forcedAuthenticationSupported = true to the
> authn.properties to enable this?

Mechanically, yes.

> I believe that while the authn/External will just check to see if the current CAS cookie is valid
> and not prompt the user, we *will* be using Duo with settings to "always prompt", so we
> will be honoring the spirit of forcedAuthentication -- users will still have to verify their
> identity with at least one factor before accessing the SP.

The lack of an answer to that question is why the feature is not interoperable in general, but usually it's the inverse since Duo's Remember Me feature tends to make honoring ForceAuthn difficult, the first factor is normally the "guaranteed" one.

The current IdP swaps the logic to set AuthnInstant to the oldest time at which it thinks somethng happened and not the newest, though that is configurable. Older versions use the newest, essentially lying to the SP about it so that they can't make an informed decision.

This SP is broken anyway, so none of that much matters, but you need to recognize that unless you actually block ForceAuthn, enabling the property is telling all SPs they can use and rely on ForceAuthn, not just this one.

> Please let me know if I am on the right track, or missing something.

That's a different question. Normalizing saying no to bugs is IMHO one of the more important tasks in operating an IdP. Once you set the expectation that broken SPs will be coddled, you will be doing it for everything.

Most of the people who complain to me about how bad their IdP config is and what a mess it all is have been shown to take the "let them get away with everything" mindset. That's why I am so vocal about it.

-- Scott