Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

  • Proof
  • Liveness
  • Source
  • Record
    • 2 different records

B Binding/Bind Credential Binding and Issuance? (if Enrollment or Issuance are overloaded by the existing frameworks or often used with different meaning)

...

#short description

C_AUTHN_???EXISTING_FACTOR Authenticate Existing Factor → TODO: short intuitive label -  C_LOGIN?

...


The applicant authenticates with a specific factor. his/her exisiting factor(s). Username/password login is typically the first existing factor that is readibly available.

This action may be used for multiple purposes:

This action may be used for the first factor (i.e. 1F_AUTHENTICATE) in order to check first factor knowledge/possession/inheritance/... or as a mean to provide user information (i.e. as a sub action of 2F_REQUEST).

Perform authentication with the existing factor(s) to prove knowlegde/possession of the respective factor(s).

This The action may also be used for the second/third/... factor to create an initial binding between digital ID and factor.

This initial binding typically needs to be verified requiring the vetting of the user's identity before it is put into effect.

It may also be used to (cross-) check second/third/... factor knowledge/possession/inheritance/...

Username/password login is typically the first existing factor that is readibly available.

Input:

checking the applicants eligiblity (see C_CHECK_ELIGIBLITY) based on the credentials used (e.g. email address compared with LDAP directory) or the attributes (e.g. affilitation) which are send in the authentication response.

Input: Credentials (e.g. username/password combination, certificate)

Output:Output: Authentication successful (yes/no), attributes is needed (e.g. affiliation)

C_USE_NEW_FACTOR (one word limit is too harsh) Use Introduced Factor TODO: short intuitive label

Usage of the introduced factor may serve multiple purposes at different stages.

...

Done by manual or automated check a directory, federated identity, or examination of s a written institutional certificate.

...

------------------------------------------------------ Template for providing example realization options ---------------------------------------------------------------------

could consider more attributes such as:

Likely to be mandatory in MFA: (yes/no)
Risks if omitted: (mostly security-related)
Effect on level of assurance: (how it increases, decreases LoA)

4:13 PM
+
Other potential technical concerns/issues
Potential organisational (IP, NREN, GEANT) concerns/issues
Potential end-user concerns/issues

Example realization options

...