MFA authentication context handling

This section discusses the implementation of local IdP support for Entra Mandate where it serves as an Identity Provider (IdP) in federation with Entra ID as Service Provider (SP).

Microsoft has announced changes to Entra ID, which requires Identity Providers to properly include authentication context information in SAML responses. These changes are documented in the following Microsoft resources:

• https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication

• https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-expected-inbound-assertions

The enhanced MFA authentication context handling feature ensures that FIC properly responds to authentication requests from Entra ID with appropriate authentication context information in SAML responses. This enables Entra ID to correctly evaluate whether the authentication meets its security requirements.

Use cases

When FIC acts as the Identity Provider, the following behaviors are expected based on the authentication request from the Service Provider:

• No authentication context or PasswordProtectedTransport:

  When the SP authentication request has no authentication context or does not specify PasswordProtectedTransport and the user successfully authenticates with MFA, then FIC will include MFA information in the SAML response to the SP.

• Mandatory MFA with successful MFA authentication:

  When the SP authentication request specifies mandatory MFA and the user successfully authenticates with MFA, then FIC will include the MFA authentication context in its SAML authentication response.

• Mandatory MFA without successful MFA authentication:

  When the SP authentication request specifies mandatory MFA and the user successfully authenticates WITHOUT MFA, then FIC will include the NoAuthnContext status code in its SAML authentication response.