MFA Interop Working Group

[Eric Goodman <>]

>> Perhaps also relevant: when the MFA Profile discussion went forward, 
>> the REFEDS framework had planned to communicate authentication event 
>> information via attributes;  e.g., 
>> “eduPersonAssurance=REFEDS_IAP/authn/mfa” to say that MFA was done (rather 
>> than AuthnContext). So much of their discussion was around how to 
>> communicate authentication information at all, and wasn’t MFA/basic 
>> specific.

>If the app cares, it will usually want to express that and restrict the IdP 
>(which can't be done with attributes, 
>at least not in practice), and if it doesn't, why communicate anything?

>But that said, that certainly explains why it wouldn't be needed, since 
>expressing nothing would be pretty 
>equivalent to basic.

For clarity, I should have said "originally". When I described our logic 
behind using AuthnContexts they modified the profile. So as I understand it 
they are back to using AuthnContext as per the profile. 

(You may recall that at one point I forwarded you my comments on this point 
off-list, asking if you were fact checking me, which was when I realized you 
weren't on that particular list...)

--- Eric