Re: [security-services] Re: ForceAuthn (was Use Cases)

["Conor P. Cahill" <concahill@aol.com>]

John Kemp wrote on 11/29/2003, 8:59 AM:

 > On Saturday, Nov 29, 2003, at 05:31 US/Eastern, Conor P. Cahill wrote:
 >
 > > I like to think of ForceAuthn as the SP asking the IdP to do
 > > whateve it takes so that the IdP can update the
 > > AuthenticationInstant in the assertion at this time.
 >
 > And that is my understanding too. I was merely pointing out that Scott
 > is actually right - it may not involve a user interaction, and may
 > simply involve checking a cached cert. without any active, direct user
 > re-authentication at all. So, the term "ForceAuthn" could be
 > misleading.

Note that it doesn't say "ForceUserInteraction".  It says "ForceAuthn" 
and Authn may or may not involve user interaction, depending upon what
credentials are being used to validate the Authn.

This applies regardless of whether the IdP is authenticating the user 
for the first time during a "session" or if it is because of the 
ForceAuthn setting on the AuthnRequest.

If an SP needs to deterrmine if a user interaction has taken place as 
part of the credential validation for the user, they need to use/require 
  an appropriate authentication context.

 > I guess the ultimate question though is whether we think that
 > ForceAuthn semantics that allow a situation where the *user* is not
 > challenged are sufficient for the SP, and if not, is this a problem?

Challenging the user is orthogonal to ForceAuthn.  Challenging the user 
is related to the authentication context that is requested by the SP, 
under the control of the SP.  The ForceAuthn can impact interactions, 
but only in conjunction with the authentication context.

So, I think things are well handled given the current set of options.

Conor