An open discussion list for topics related to the eduGAIN interfederation service.

[Chris Phillips <Chris.Phillips AT canarie.ca>]

This is a follow on email from the eduGAIN slack #general channel chat about MFA+ADFS.

 

There’s a lot to unpack on MFA with any combination of IdP not just ADFS. That said, our quick testing Scott K and I did confirmed(at least for us) that the expected behaviour for a Shib v3.1.0 SP asking for REFEDS MFA AuthContext from ADFS works -- ADFS doesn’t handle REFEDS MFA and offers an appropriate error response that the SP exhibits.

 

The mini testbed was Server 2016 v1607.14393.3750+ ADFSToolkit-v1. ADFS had no local multiple AuthN settings and Shib v3.1.0 SP had the REFEDS MFA context settings.  The screenshot doesn’t look too fancy but it *is* the expected error page rendered by the SP. It also means the SP can do some clever things too.

SAML tracer had the expected responses in the SAML exchanges and left those out.

 

 

We expect server 2019 to behave similarly.

 

 

Also pointed out from from Thijs Kinkhorst on the topic on ADFS:

From our experience you need to send http://schemas.microsoft.com/claims/multipleauthn  as the requestedauthncontext to trigger MFA in ADFS

You can then add an attribute in the response called http://schemas.microsoft.com/claims/authnmethodsreferences  that will tell you if it actually succeeded.

 

 

Scott K and I didn’t test this scenario/pathway as our ad-hoc testbed wasn’t configured for this and doesn’t look ‘SAML2 standard’ being claims oriented.

 

From Scott C:

Uses of Apache's ErrorDocument command make it pretty clean to create MFA-only trees of content and have it dynamically step-up as needed by requesting/requiring something. So I wouldn't say it's a ton of work if the rules are that clean, but usually it's an "app" and not based on URL, and that's just never going to be anything but a slog

 

Scott K and I did not test this behaviour either but also landed at this conclusion as well.

It looks promising if one wants to be more elegant to step users up and encourage more thought here on some good recipes if anyone has them to share.

 

There’s more to the story on MFA and how to gracefully and compliantly handle use cases and hope this helps others on the journey. There certainly are a lot of moving parts in a good user experience.

 

If there’s a better place than edugain-discuss for this, let us know and feel free to bring this conversation there.

 

C.

Attachment: smime.p7s
Description: S/MIME cryptographic signature