<html><head><style type='text/css'>p { margin: 0; }</style></head><body><div style='font-family: arial,helvetica,sans-serif; font-size: 12pt; color: #000000'>I have a test Shib 2.4 instance with multi-context-broker and its Duo plugin working. By setting a per-user LDAP attribute mapped to "assurance," I can toggle the 2FA requirement off and on. Thanks!<br><br>I have not yet figured out how to configure a specific SP to require higher assurance, though I see that it's very much intended to work. I'm sure I'll figure it out eventually, but more explicit pointers would be welcome.<br><br>Next step, has anyone looked into changing the MCB assurance requirement if the source IP address or geocode is suspicious? For example, webmail logins from Nigeria, or some "grand unified logging program" that knows that this username logged on from three different continents today. Is HTTP REMOTE_ADDR address available to resolver:DataConnectors? I know that some big .edu's have done this sort of thing before, but I'm pretty sure that work predates MCB.<br>-- <br><div><span name="x"></span>Rich Graves <rgraves@carleton.edu><br></div></div></body></html>