forceAuthn, MFA, RemoteUser

[Joseph A Jerista]

Thanks to both of you for the responses.  I will write an external flow and
use the RemoteUser servlet as the base.
Really appreciate the guidance, it saves a lot of time to go down the
correct path.

I do believe we'll clear a cookie to force reauth, that approach will work
well for us.
Joe Jerista



On Mon, Oct 28, 2024 at 6:34 PM Christopher Bongaarts via users <
users at shibboleth.net> wrote:

> On 10/28/2024 9:45 AM, Cantor, Scott via users wrote:
> > The MFA flow already supports ForceAuthn. It's your external mechanism
> that doesn't.
> >
> > Nor is building an External hook that supports authn "writing a new
> flow", they're fundamentally different approaches. External is about not
> having to build a webflow.
> >
> > External is a login flow that calls out to a servlet/JSP. Your job is
> building that, only. RemoteUser is just External with a built-in servlet.
>
> Having done both, I concur with Scott - building an External method is
> less work than writing a new authn flow.  You could even use the
> RemoteUser servlet as a base to work from.
>
> The biggest issue is, assuming you want to force reauthentication on the
> first factor, how to signal it.  Depending on the first factor, it might
> be a matter of adding parameters to a redirect, or clearing a cookie for
> the first factor before redirecting to the servlet.
>
> --
> %%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
> %%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
> %%  University of Minnesota    %%  +1 (612) 625-1809    %%
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241029/01adc1f3/attachment.htm>