Organizational Authentication Policy

The organizational authentication policy feature is currently under development

A university may impose an authentication and mult-factor policy to its members. This can be done individually for each member by setting the attribute swissEduIDAffiliationSecurityPolicy in her/his linked affiliation.

The organizational authentication policy is interpreted a minimal requirement. When a user accesses a service, the authentication policy a university is combined with the policies of other univerversities, with the service's configuration and with the user's security settings to an effective policy as described here.

Notes:

  • A policy of an organization can't generally disable MFA for any person. If a service enforces MFA, an organisation can not overrule this. Also, if User X has affiliations to Organisations A and B, then Organisation A can not overrule any MFA parameters from Organisation B.
  • The MFA settings for a user will not automatically change if she/he loses an affiliation. However, the user might have the chance to lower the MFA parameters or even disable MFA.

User attribute

swissEduIDAffiliationSecurityPolicy

swissEduIDAffiliationSecurityPolicy is the attribute used as container to store various security related policies in affiliations. The purpose is to make the organization policy for a user accessible to the IdP. It is not to be used as SAML attribute or OIDC claim to be transmitted to services. However, just like other affiliation attributes, it is provisioned from an organization to edu-ID using the push or pull method.

Name swissEduIDAffiliationSecurityPolicy
Description  Security criteria to be applied to various processes, especially the login process. Policy applicable per affiliation.
 Vocabulary JSON data containing the authentication criteria.
Type of JSON data: AffiliationSecurityPolicy (see below)
 OID 2.16.756.1.2.5.1.1.2025
 # of values single
Example values 
{
  "mfaPolicy": {
    "mode": "enforced",
    "maxDeviceTrustDuration": "P30D",
    "allowedSecondFactorTypes": ["totp", "sms"]
  }
}
Required 

No

An absent attribute is equivalent to an attribute with an empty value (i.e. corresponds to JSON value {}).

 

Specification of AffiliationSecurityPolicy JSON Data:

{
  "mfaPolicy": {
    "mode": String,
    "maxDeviceTrustDuration": String,
    "allowedSecondFactorTypes": Array.of(String)
  }
}

mode: is a string and accepts the following values:

  • enforced: Always require MFA
  • disabled: Don't require MFA. (Default value)
  • on_demand: Require MFA if service reqests it (deprecated)

Default value: disabled

maxDeviceTrustDuration: sets the maximum duration of the "remember browser" feature.

  • ISO 8601 time duration (e.g. "P7D"): Maximum duration, independent of current SSO session.
  • A value of 0 is specified as P0D (or PT0S), i.e. as a regular ISO 8601 time duration.

Its meaning is: Don't enable and don't evaluate "remember browser" this time. Ask for the second factor if the current SSO session requires it.

If not set, a default value will be applied when the policy is evaluated (currently 30 days).

allowedSecondFactorTypes: is a list of allowed 2-step login token types. Supported types/combintations:

  • [totp]
  • [totp,sms]

If not set, a default value will be applied when the policy is evaluated (i.e. all supported second factor types are considered). That is, to allow any type, the property must not be set.

Note: Setting this value to [] (empty list) strictly means "don't allow any second factor type" and should never be used.