<div dir="ltr"><blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex" class="gmail_quote"><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px">The second group would be applications that tailor the access they provide based on the type of authentication performed, perhaps later requesting (and requiring) MFA when sensitive/risky transactions are attempted.</span></blockquote><div class="gmail_default" style="font-family:tahoma,sans-serif;color:rgb(0,0,0)"><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px"><br></span></div><div class="gmail_default" style="font-family:tahoma,sans-serif;color:rgb(0,0,0)"><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px">Or where the institution knows that mfa correlates to another distinction the application already makes; t</span><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px">he application doesn't necessarily have to make decisions based on the type of authN. It'd be nice, but one does not always have that level of control/configuration over an app.</span></div><div class="gmail_default" style="font-family:tahoma,sans-serif;color:rgb(0,0,0)"><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px"><br></span></div><div class="gmail_default" style="font-family:tahoma,sans-serif;color:rgb(0,0,0)"><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px">Use case: application X has some users with elevated access internally (the application admins). By convention all those application administrators have mfa available to them. They still want people without mfa to access the application, because that's its main use.. But if you have mfa available for some other reason, it's not a bad thing for you to have your session mfa-protected. It's just not relevant to the application.</span><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px"><br></span></div><div class="gmail_default" style="font-family:tahoma,sans-serif;color:rgb(0,0,0)"><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px"><br></span></div><div class="gmail_default" style="font-family:tahoma,sans-serif;color:rgb(0,0,0)"><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px">May I suggest some vocabulary for the second group: "mfa preferred", vs. "mfa required".</span></div><div class="gmail_default" style="font-family:tahoma,sans-serif;color:rgb(0,0,0)"><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px"><br></span></div><div class="gmail_default" style="font-family:tahoma,sans-serif;color:rgb(0,0,0)"><span style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:12.8px">-Les</span></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><br><hr style="color:rgb(0,0,0);font-family:'times new roman','new york',times,serif;font-size:16px"><div style="color:rgb(0,0,0);font-family:'times new roman','new york',times,serif;font-size:16px;text-align:right"><span size="2" style="color:rgb(153,102,51);font-size:small">Les LaCroix '79 </span><span style="color:rgb(153,102,51)">|</span><span size="2" style="color:rgb(153,102,51);font-size:small"> </span><span size="2" style="color:rgb(153,102,51);font-size:small">Strategic Technologist<br></span><span size="2" style="color:rgb(153,102,51);font-size:small">Carleton College </span><span style="color:rgb(153,102,51)">|</span><span size="2" style="color:rgb(153,102,51);font-size:small"> 1 N. College St. </span><span style="color:rgb(153,102,51)">|</span><span size="2" style="color:rgb(153,102,51);font-size:small"> MS 3-ITS </span><span style="color:rgb(153,102,51)">|</span><span size="2" style="color:rgb(153,102,51);font-size:small"> Northfield, MN 55057<br></span><span size="2" style="color:rgb(153,102,51);font-size:small">507.222.5455 | <a href="https://calendar.google.com/calendar/embed?src=llacroix%40carleton.edu&ctz=America/Chicago" target="_blank">free/busy</a></span></div></div></div></div></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On Thu, Jan 11, 2018 at 11:00 AM, David Walker <span dir="ltr"><<a href="mailto:dwalker@internet2.edu" target="_blank">dwalker@internet2.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div text="#000000" bgcolor="#FFFFFF">
The second group would be applications that tailor the access they
provide based on the type of authentication performed, perhaps later
requesting (and requiring) MFA when sensitive/risky transactions are
attempted.<span class="HOEnZb"><font color="#888888"><br>
<br>
David</font></span><span class=""><br>
<br>
<br>
<div class="m_-5877484936968638363moz-cite-prefix">On 01/11/2018 08:24 AM, Peter Schober
wrote:<br>
</div>
<blockquote type="cite">
<pre>* Paul B. Henson <a class="m_-5877484936968638363moz-txt-link-rfc2396E" href="mailto:henson@cpp.edu" target="_blank"><henson@cpp.edu></a> [2018-01-10 22:40]:
</pre>
<blockquote type="cite">
<pre>Applications will fall into three groups; those that do not need MFA
at all, those that will use MFA if available but still work with
just a password otherwise, and those that strictly require MFA and
will fail if it does not succeed. I'm not sure yet where this
application delineation information will be stored.
</pre>
</blockquote>
<pre>I may be restarting what Andrew and Tom already said but AFAIU that
second group of service doesn't exist: Either the service requires MFA
(and states that much in its request or in your local config) or it
doesn't (meaning it will take what it gets).
Not sure that helps (or is accurate) but maybe reducing the possible
states to two (force MFA or don't) makes this easier for you?
-peter
</pre>
</blockquote>
<br>
</span></div>
<br>--<br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br></blockquote></div><br></div>