MFA Interop Working Group

[Eric Goodman <>]

>> For clarity, I should have said "originally". When I described our 
>> logic behind using AuthnContexts they modified the profile. So as I 
>> understand it they are back to using AuthnContext as per the profile.

>If so, then I think my comment to them stands, I'd still like to see 
>something defined for "not MFA" for completeness to cover all the bases.

Gotcha. 

At the risk of forwarding all the REFEDS threads to this list, there was also 
a back and forth on "minimum vs. exact". 

With their attribute based model, they allowed an SP to say "I require 
minimum good-entropy" (lower level than MFA) and for the IdP to respond with 
"I did MFA". That doesn't work with AuthnContext if you presume AuthnContexts 
IdPs are only doing "exact" matching. They changed language to talk about 
requesting multiple authncontexts in priority order (which was actually the 
specific question I asked you off list) as we called out in this workgroup.

I'm guessing their looking at these profiles as implicitly hierarchical was 
also a factor in not seeing the value of having "Basic" defined.

--- Eric