Assurance

[Tom Scavo <>]

On Wed, Mar 12, 2014 at 4:49 PM, David Walker 
<>
 wrote:
> So this is more about session integrity than authentication, right?

I still think it's authentication. Some people call it step-up
authentication. The SP already knows the user, but now wants
additional, independent assurances that this is so. In distributed
fashion, this requires the SP to pass the identity of the user in the
AuthnRequest while requiring the IdP to authenticate the identified
user with an additional factor. (Who said there's no use for
AllowCreate="false" :)

Visualize numerous single-factor IdPs sprinkled across the
network...multiple, single-factor IdPs supplying step-up
authentication services if and when they're needed (where is not an
issue). Easier to deploy but much harder to subvert.

Tom