forceAuthn, MFA, RemoteUser

[Cantor, Scott]

> The IDP5 docs recommend creating an External authn flow to
> handle a forcedAuthn requirement.

Well, that's more of a statement that, pretty much by definition, RemoteUser can't do it, so if you need an externalized approach that supports ForceAuthn, that's all there is really.

> The main point of this mail is to ask: Could there be another
> solution?

Pretty much by definition, no. I mean, sure, "don't do it externally" but that's a deployment imperative in the end.

You can also just refuse to honor ForceAuthn and have the IdP break the standard if you choose to. Some of that would depend on the SP.

An SP that ues ForceAuthn has to do a whole lot of things to make it mean something, and 99.9% of them don't. So if it's literally just a bug and you can't get them to fix it, "ignore it" is not always a crazy thing to do.

> Writing a custom External Authn is a lot of effort for us to
> support a single SP.

The difficulty would depend on exactly how you were intending to actually honor ForceAuthn.

Note also that one way to handle ForceAuthn is to force *one* of the factors to be applied. If you had Duo without remember me in place, you could force that factor at least, and still honor the spirit. The letter of the standard simply doesn't address multi-part approaches.

> I have created a custom flows before (just not External) so I
> could in theory write a new "authn/mfaForcedAuthn"

The MFA flow already supports ForceAuthn. It's your external mechanism that doesn't.

Nor is building an External hook that supports authn "writing a new flow", they're fundamentally different approaches. External is about not having to build a webflow.

External is a login flow that calls out to a servlet/JSP. Your job is building that, only. RemoteUser is just External with a built-in servlet.

-- Scott