<div dir="ltr">I restrict release of the role attribute to AWS based on the authN method - that is, release the AWS roles if and only if the authN method is MFA.<div><br></div><div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span class="gmail-s1"> </span><span class="gmail-s2"><AttributeRule </span><span class="gmail-s3">attributeID</span><span class="gmail-s1">=</span><span class="gmail-s4">"</span><span class="gmail-s5">AWS</span><span class="gmail-s4">role"</span><span class="gmail-s2">><br></span><span class="gmail-s2"><!-- do not release unless the authN was Duo 2FA --><br></span><span class="gmail-s1"> </span><span class="gmail-s6"><PermitValueRule </span><span class="gmail-s3">xsi</span><span class="gmail-s7">:</span><span class="gmail-s3">type</span><span class="gmail-s1">=</span><span class="gmail-s2">"basic:AuthenticationMethodString"</span><span class="gmail-s6"> </span><span class="gmail-s3">value</span><span class="gmail-s1">=</span><span class="gmail-s2">"<a href="https://iam.alaska.edu/trac/wiki/mfa">https://iam.alaska.edu/trac/wiki/mfa</a>"</span><span class="gmail-s6"> /><br></span><span class="gmail-s1"> </span><span class="gmail-s2"></AttributeRule></span></blockquote><div><br></div><div>David Bantz</div><div> </div>
</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Sep 19, 2016 at 11:42 AM, Liam Hoekenga <span dir="ltr"><<a href="mailto:liamr@umich.edu" target="_blank">liamr@umich.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Our security folks want our AWS folks to require MFA for access to the AWS web console / portal.<div><br></div><div>As far as I know, AWS only supports unsolicited SSO. Is there any way to force MFA on unsolicited SSO?</div><span class="HOEnZb"><font color="#888888"><div><br></div><div>Liam</div></font></span></div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br></blockquote></div><br></div>