mitigating the effects of forceAuthn terrorism

[Timo Tunturi]

On 09/04/2026 17.36, Scott Cantor via users wrote:
> ForceAuthn doesn't "downgrade" anything, nor does it "destroy" any existing results or "do local SLO" in this code, though I suspect in most implementations it might.
> 
>> The end result is awkward where the user re-authenticates with a weak/vulnerable mechanism and his global session gets downgraded to that mechanism as well.
> 
> That's not what it does, so far as I know.

I didn't dig into it any deeper than testing like this:

1) Start with a fresh session
2) Log in to service X that doesn't request anything specific. 
Authenticate with WebAuthn. Logs show the refeds MFA acc ref.
3) Log in to service Y that requests forceAuthn + password. Authenticate 
with password. Logs show the password acc ref.
4) Log in to service Z that doesn't request anything specific. SSO works 
so no need to authenticate. Logs show the refeds SFA acc ref.

If that isn't how it's supposed to work then I'm gonna have to dig 
deeper for why it works like that for me.

My authn-comparison is set up in a way where the MFA acc ref has the 
highest priority so it is selected if the subject has it.

-- Timo