Versions Compared

Old Version 5

changes.mady.by.user Fredrik Domeij

Saved on

compared with

New Version 6

changes.mady.by.user Peter Havekes

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

comment #Line/Reference #Proposed Change or QueryProposer / AffiliationAction / Decision (please leave blank)
14.3 Validity LifetimeSetting a hard limit on 12 hours isn't logical. A IdP could use different vectors (location, device, behavior) to determine if mfa is needed, and prevent MFA-fatigue by only requesting MFA when needed. When specifying a time-limit, a period greater than 24 hours is more practical, to spread the login-times over the (working) day. Proposal: Allow a maximum window of 8 daysPeter Havekes / SURF
25.1.3.3 ForceAuthnThere are use cases where a user must always preform MFA authentication. Examples are
  • SP's that require MFA on each login by policy
  • Use MFA authentication for signing a transaction, like entering a grade list

ForceAuthn is very useful in these cases.

Proposal: If both ForceAuth and an AuthnContextClassRef element containing the REFEDS MFA Profile are specified, the IdP MAY force the user to use his first factor, and MUST force the user to use his second factor.

Peter Havekes / SURF