Changes between Version 11 and Version 12 of mfa

Timestamp:

04/17/15 09:44:13 (11 years ago)

Author:

dabantz@…

Comment:

--

mfa

@@ -33 +33 @@
 Currently (in the initial roll-out of two-factor authentication at UA) you can request this group membership and use of !DuoSecurity two-factor authentication by request to IAM (email iam@alaska.edu).
 
+(3) More complex logic is possible.  See the section below on "per SP" configuration of the MCB.
+
 == Enrolling and configuring your phone or other second factor ==
 If your authentication invokes two factor authentication (via either of the methods above - because a service requires it or because you are in the security group using two factor) and you have not previously used Duo Security with UA, you will be presented with a page to automatically enroll and designate your phone number to be used for second factor.  
@@ -52 +54 @@
 
 More detailed user documentation is at http://guide.duosecurity.com/manage-devices .
+
+== Configuring the MCB to require 2FA based on the SP ==
+Scott Koranda via shibboleth.net 
+2015-04-17
+
+to Shibboleth 
+Hello,
+
+The MCB can be configured to use an attribute to determine which
+authentication contexts are allowed for a user, ie.
+
+<idms attributeResolverID="allowedAuthContexts" />
+
+Further the attribute can be of type "Script" and have a dependency on
+other attributes such as the value of isMemberOf from an LDAP query on
+the principal.
+
+Still further, the script can ascertain the SP by making a call to
+
+peerEntityId = String(requestContext.getPeerEntityId());
+
+Is it not the case then the logic in the scripted
+"allowedAuthContexts" attribute can be such that it can make a
+decision on which authentication contexts be allowed for a user by
+combining the user's LDAP record and the entityID of the SP which the
+user is attempting to access?
+
+The mechanism described above would allow for a per-SP/per-user
+"configuration", though admittedly it is not particularly elegant....It appears to work well with my sandbox.
+
+I should add that I am primarily focused on SPs that do not send an
+explicit request for authentication contexts.
+
+Thanks,
+
+Scott K