<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 01/05/2017 03:14 PM, Cantor, Scott
wrote:<br>
</div>
<blockquote
cite="mid:9846A6064BD102419D06814DD0D78DE11BF7CF39@CIO-TNC-D2MBX02.osuad.osu.edu"
type="cite">
<blockquote type="cite">
<pre wrap="">We are wondering if anyone else has implemented Duo/MFA to be triggered
only on un-trusted networks.
</pre>
</blockquote>
<pre wrap="">
We have an isolated case of it and the volume was such that it was simpler to just let the Duo bypass feature deal with it for the time being. It was a union contract thing.
</pre>
<blockquote type="cite">
<pre wrap="">Specifically if the SP is requesting an MFA authentication by specifying an
authnContextClassRef, should we allow the IDP to lie to the SP that the
context was satisfied?
</pre>
</blockquote>
<pre wrap="">
Well, nobody can really answer that except you. If you're asking me, no, I don't think that's fair, particularly at the scale/scope you're proposing. That's a huge number of transactions to be lying about IMHO. But if you're asking me if you can make it lie, yes, though I haven't really thought much about what that takes.</pre>
</blockquote>
<br>
I'd be tempted to define two authnContextClassRefs, one for MFA, and
one for "from a trusted network," and have applications request both
to allow either. That way, you aren't lying, and SPs can choose
whether they trust the "trusted" networks.<br>
<br>
<blockquote
cite="mid:9846A6064BD102419D06814DD0D78DE11BF7CF39@CIO-TNC-D2MBX02.osuad.osu.edu"
type="cite">
<pre wrap="">
</pre>
<blockquote type="cite">
<pre wrap="">Alternatively, we could leave SPs requesting nothing additional in their
authnContextClassRef and have the IDP determine when an MFA auth is
required; is that safe and scalable?
</pre>
</blockquote>
<pre wrap="">
Depends how many apps you want to take on that job for, and bear in mind that it also means you probably own the "turn off Duo" responsibilty in the event that Duo was down. Our view here has been to encourage the app to make that decision since it's their risk to accept password logins, not one central decision for everybody.
Is it hard to impose, though? No, not really. You do, though, need to either require signed requests and/or disable the ability for SPs to request an AuthnContext, or your rule will be circumventable.
There will always be services that require you impose the requirement for them anyway.
-- Scott
</pre>
</blockquote>
<br>
</body>
</html>