FAQ/Supporting Materials: MFA/SFA (authentication assurance)

Testing your SAML Identity Provider

• SWITCHaai’s attribute test service has a button you can click to ask the SP request SFA, MFA or "MFA or SFA" authentication context from your IdP (you need to first log in to that page "normally" via your IdP)

Supporting Materials

• Examples on SFA/MFA authentication contexts in SAML 2.0 and OIDC protocol flow
• MFA/SFA configuration examples - Shibboleth (as SAML IdP)
• MFA/SFA configuration examples - SimpleSAMLphp (as SAML IdP)
• MFA/SFA with ADFS (as SAML IdP)

There are some useful documents on supporting MFA over on the InCommon wiki.  We hope to develop more advice and guidelines soon.  You might be interested in:

• Shibboleth Multifactor Authentication Configuration.
• InCommon MFA Usage Guidance.