| Info |
|---|
The SWAMID Person-Proofed Multi-Factor Profile was descided by SWAMID Board of Trustees on the 12th of September 2018. The decided profile is published at https://www.sunet.se/swamid/policy/al2mfa/ |
| Note | ||
|---|---|---|
| ||
This is a SWAMID working draft for discussions within the community. |
Terminology and Typographical Conventions
...
Definition of terminology
Home Organisation: The SWAMID Member Organisation with which a Subject is affiliated, operating the Identity Provider by itself or through a third party.
Member Organisation: Used in this document as a synonym for Home Organisation
Subject: any natural person affiliated with a Home Organisation, e.g. as a teacher, researcher, staff or student.
Identity Provider (IdP): The system component that issues Attribute assertions on behalf of Subjects who use them to access the services of Relying Party.
Relying Party (RP): A Service that relies upon a Subject’s credentials, typically to process a transaction or grant access to information or a system. Also called a Service Provider (SP).
Second factor: A second independent factor that is used in addition to the subject's first factor in order to provide the subject with the ability to use multi-factor authentication. Normally this means adding a second factor where the subject's first factor is a memorised secret (i.e. a password).
Full multi-factor: A complete new set of credentials assigned to the subject in order to provide the subject with the ability to use multi-factor authentication. This new set of credentials is by itself composed of at least two dependent factors (e.g. a smart card) and does not depend in any way on the normally used memorised secret (i.e. a password) belonging to the subject.
2. Purpose, Scope and Summary
This document defines how a SWAMID member organisation SHOULD implement a multi-factor authentication solution in order to be certified by SWAMID for of multi-factor authentication in a federated environment.
This multi-factor profile is an extension to REFEDS MFA Profile (https://refeds.org/profile/mfa), applicable for Swedish Higher Education.
3. Syntax
The member organisation's Identity Provider is tagged in the SWAMID federation metadata with the assurance certification attribute: http://www.swamid.se/policy/authentication/refeds-mfa
In accordance with REFEDS MFA Profile:
In a SAML assertion, compliance is communicated by asserting the AuthnContextClassRef: https://refeds.org/profile/mfa
4. Compliance and Audit
The Member organisation MUST be certified for SWAMID Identity Assurance Level 2 Profile.
Only subjects currently at SWAMID Identity Assurance Level 2 are allowed to authenticate themselves according to this Profile.
The Member organisation MUST document valid parts regarding muti factor in the Identity Management Practice Statement and submit the Identity Management Practice Statement for approval by SWAMID Board of Trustees.
...
Processes for issuing and assigning of credentials (second factor or full multi-factor) MUST be documented in 5.2 Credential Issuing (more precisely in 5.2.5).
Issuing of second factor or full multi-factor MUST be done using one of the following methods
On-line multi-factor authenticating the Subject with SWAMID MFA Profile or higher level using an external Identity Provider compliant with SWAMID MFA Profile or higher
In-person visit at a service desk in combination with identity proofing as defined by the Swedish Tax Agency for issuance of the Swedish Tax Agency identity card
In-person visit at a service desk in combination with identity proofing with an international passport fulfilling ICAO Doc 9303, an EU/EES national identity card fulfilling the European Commission Regulation No 562/2006 or an EU/EES driving license fulfilling the European Parliament and the Council of European Union Directive 2006/126/EC
Off-line using a certified mail to a postal address (sv. rekommenderat brev med personlig utlämning) in combination with a time-limited one time password/pin code.
- Off-line using a certified mail to a postal address (sv. rekommenderat brev med personlig utlämning) with a preregistered device, unique for the user, that will be considered as a vetted token on first use.
...
5. Criteria
The Member organisation MUST perform a successful technical validation of their Identity Provider in the official SWAMID multi-factor validation service.
Guidance: The validation service is located at https://mfa-check.swamid.se
Original criteria repeated from REFEDS MFA Profile for convenience
By asserting the URI shown above (note: https://refeds.org/profile/mfa), an Identity Provider claims that:
...