RE: [security-services] Re: ForceAuthn (was Use Cases)

[Scott Cantor <cantor.2@osu.edu>]

> Well, your point is certainly well taken, but I guess I wasn't 
> necessarily equating ForceAuthn with "InteractWithUser". To me, all 
> this says is for the IdP to at least check the authentication status of 
> the user, following *their* policy. This may include a user 
> interaction, but as you point out below, it may not. So, perhaps the 
> term 'ForceAuthn' is somewhat misleading?

"checking authn status" sounds a little light for something that I thought
was meant to imply a bypassing of SSO. I have generally assumed that there
was a connection between ForceAuthn and IsPassive. They can't be easy rolled
into one field, but setting both to true doesn't seem viable, so I think
they need to be under a co-constraint.

So I guess I do think that ForceAuthn gives some kind of license to interact
with the user, though maybe it's not mandating one. Very few authentication
technologies could claim to be doing authentication and not interacting
though. Not any, depending on your viewpoint.

> > Client certs are tops on that list, since the cert store usually 
> > caches the
> > PIN and repeatedly authenticates with the key for a length of time, 
> > often controlled by the browser, not the IdP.
> 
> But this may be the case regardless of the setting of ForceAuthn, no?

Yes, but if Force is off, there's no implication that the IdP has to be able
to do anything specific re: forcing an interaction.

> I think you are saying that ForceAuthn=true implies that the IdP 
> actually interact with the user, and that such an interaction is the 
> only way of re-authenticating the user in a real sense.

At the very least, I think true implies the IdP *could* interact. Whether
it's the only way, I'd hesitate to claim that. I'm not an expert in
authentication at that end. I can't personally imagine anything that I'd
feel satisfied with as a relying party.

> And, I don't 
> know that we could ever get that kind of effect within the protocol 
> itself, for the reasons you have noted. But, I also think that in an 
> environment where a "real" authentication is important to the SPs, that 
> ForceAuthn may very well imply that the IdP will not depend on cached 
> cert PINs or other methods where a user interaction is not required.

I would be in favor of codifying that. Or if not, AuthnContext should
definitely take it into account. Probably already does.

-- Scott