Inspect Authentication Methods Reference

[mhebrard]

Is your feature request related to a problem? Please describe.
It would be great if we could inspect (print / audit log) the login of users and especially inspect the Authentication Methods Reference (amr) used.

Describe the solution you'd like

• updating the code to retrieve this information when the user logs in, and store it in an audit log.
• A way to view audit logs
• Update our release candidate so that the changes can be deployed to UAT (and eventually prod)

[mhebrard]

Minimally we want to record email + amr values in the meta json entry of the audit log
If that is not doable, please provide clarity on the login flow and existing messaging.

[tkallady]

I've added a console log to print out the claims which includes AMR if available.

AAF
AAF provides equivalent ACR, but the value is: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport. Even though 2FA was used.
Auth0
I have added into auth0 an action which inserts login information from the upstream idP (google etc).
https://manage.auth0.com/dashboard/us/dev-xedas2iasb2dv6bb/actions/library/details/8fc8973d-0fe2-481b-9a1b-3b54628c166c
Auth0 is currently being used with Google. So login is auth0 -> google -> garvan okta.
It does not pass through AMR/ACR.
It may be possible to set it up to log in directly with auth0->okta, which may insert the AMR but not sure. This would require setting up a new Okta OIDC app with IT.

[mhebrard]

After investigation on the operationalization for MFA signaling, I appreciate the difficulty of implementation.

Peter Modica

Have not explored if/how Auth0 can signal MFA use to downstream apps. You can configure an MFA requirement within Auth0 for all or a specific application

James Gree

Using our own auth provider that we know is configured correctly meets the policy requirement.
I remain strong in my stance that the signalling is required if we’re accepting auth from an external source.