MFA Interop Working Group

[Eric Goodman <>]

Good point on SP enforcement, though I'll note that we were inconsistent on 
that in other areas of the profile as well (see "ForceAuthn", which is 
defined for IdP support but not SP enforcement). 

I'll propose all three comments once I figure out where such comments should 
be routed. (And yes that's a request for guidance on how to submit comments 
if people have guidance to provide.)

--- Eric 

-----Original Message-----
From: 

 
[mailto:]
 On Behalf Of Cantor, Scott
Sent: Friday, October 07, 2016 1:06 PM
To: Nicholas Roy; 

Subject: RE: [MFA-Interop] Software support for our MFA Interoperability 
authnContext value

> Seems like this is something that SSP should support if it doesn't, 
> and I don't think that missing it should block adoption of this profile.
> The profile should drive software that doesn't support it, to support it.

This is basic SAML conformance stuff, but I think Eric more or less asked 
just yesterday that the implementation profile go ahead and include explicit 
requirements for this to call it out. There's also a more important and 
generally overlooked piece, which is that if the SP requests it, it needs to 
be able to enforce it (and if not, the application had better know that it 
hasn't been enforced). That could be added to the implementation profile as 
well.

-- Scott