Child pages
  • FAQ/Supporting Materials: SFA/MFA (authentication assurance)
Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 14 Next »


Unable to render {children}. Page not found: Current.


  • Q: Does MFA impose requirements on the quality of the two factors?

    • A: No, only that they are independent. In that sense, MFA is more like an interoperability profile unlike SFA which is more specific on the properties of the factor.

  • Q: Is compliance to SFA required in order to qualify for MFA?
    • A: No, both profiles may be used completely independent of each other.

For a more comprehensive REFEDS MFA FAQ please see MFA Profile FAQ.


  • Q: Does SFA impose requirements on password lifetime?
    • A: No, SFA does not require password rotation.
  • Q: Are the passwords whose secret basis is ≥72 characters actually required to have special characters?
    • A: No, SFA does not impose requirements on password complexity. The CSP qualifies to the ≥72 characters if it allows the user to choose their password from that character basis.
  • Q: Does compliance to one profile of SFA/MFA ensure compliance to the other one?
    • A: No. Although MFA is considered the more secure profile, the requirements are significantly different from SFA and vice versa.
  • Q: Does SFA require a strict rate limit?
    • A: No, SFA just requires any protection against online guessing. It is not required to implement specific controls or define a strict rate limit. The organisation itself might decide which measures are appropriate.

Testing your SAML Identity Provider

  • SWITCHaai’s attribute test service has a button you can click to ask the SP request SFA, MFA or "MFA or SFA" authentication context from your IdP (you need to first log in to that page "normally" via your IdP)

Supporting Materials

There are some useful documents on supporting MFA over on the InCommon wiki.  We hope to develop more advice and guidelines soon.  You might be interested in:

  • No labels