MFA Interop Working Group

[Eric Goodman <>]

Sorry, that should say "Framework-related assertions sent". 

The Assurance Framework is very VoT-like, so has eduPersonAssurance values to 
indicate eppn reassignment, level of identity proofing and authentication 
process (MFA) used. Only one of those categories maps to AuthnContext, so 
it's kind of an outlier here.

--- Eric

-----Original Message-----
From: 

 
[mailto:]
 On Behalf Of Eric Goodman
Sent: Wednesday, March 01, 2017 3:58 PM
To: 

Subject: RE: [MFA-Interop] FW: [refeds] Consultation: REFEDS MFA Profile

>> With their attribute based model, they allowed an SP to say "I 
>> require minimum good-entropy" (lower level than MFA) and for the IdP to 
>> respond with "I did MFA".

>How would they expect the SP to say that?

Hmmm. Looks like the SP doesn't literally request, but indicates they want 
profile information sent. Conforming IdPs just populate the 
eduPersonAssurance values appropriate to what was done, and the SP examines 
and makes decisions based on the assertion.

The current draft doesn't have the old language around MFA vs. other levels 
of authentication, so I don't know or remember how/if it signaled the need 
for MFA "on the wire" vs. expecting the SP to display "hey dummy, log in 
again but use MFA this time" in a message to the end user.

--- Eric