Discussion of use cases and implementation experience integrating with Workday

[Tom Scavo <>]

On Thu, Nov 12, 2015 at 10:28 AM, Belcher, C W
<>
 wrote:
>
> My question for the group is: If you were to use this functionality, how
> would you prefer the two-factor authentication be accomplished?
>
> 1. Use OTP functionality in Workday (delivered via SMS or email, or perhaps
> using a TOTP app/token)
> 2. Use SAML (using a different authentication context from your SAML-based
> first-factor authentication) to perform the 2FA at your IdP
> 3. Use another process?

Seems like #2 is the overwhelming favorite :-) and as it turns out,
SAML supports step-up authentication (at least as I understand the use
of the term here). If you take a look at the SAML core spec, you'll
see that the <samlp:AuthnRequest> element takes an optional
<saml:Subject> child element. Since the latter is known to the SP in a
step-up scenario, the SP could send a (signed?) AuthnRequest with
appropriate Subject and RequestedAuthnContext to the IdP to initiate
step-up authentication.

This is, of course, an atypical use of the SAML AuthnRequest protocol,
but the fact that the protocol supports step-up directly may be of
value here.

Tom