RE: Cosign Multi-factor Authentication Spec

["Drumm, Daniel" <dgdrumm@xxxxxxxxxxxx>]

BTW,

Seth mentioned the futility of passing a "OTP=BOGUS" name/value pair
back in the query string from weblogin. It informs the referring filter
that the OTP validation wasn't "real", but there is no way of informing
any further websites of that fact. 

Given that, I'm excluding any further mention of distinguishing between
real token use, and an opt-out user. 

Instead, this is a question of authorization. If another campus entity
is concerned that they shouldn't trust MAIS users because MAIS users are
allowed to seem as if they used two factors when, in fact, they did not
- then MAIS users should not be included in the authorization layer of
the web app, whatever it happens to be.

Sorry - this doesn't relate to the topic of authentication requirement
by path, but I wanted to mention it.

-----Original Message-----
From: Wesley Craig [mailto:wes@xxxxxxxxx] 
Sent: Tuesday, October 11, 2005 4:10 PM
To: Carson, Cassandra
Cc: Meyer, Seth; Linderman, Mark; cosign-discuss Discussion;
mais.twofact.tech@xxxxxxxxx; Dandamudi, Bindu; Thomas, Katarina
Subject: Re: Cosign Multi-factor Authentication Spec

On 11 Oct 2005, at 12:08, Carson, Cassandra wrote:
> Just to be sure....Will this also work in reverse?  Meaning the user
> visited henonprodop, but provided their token and then went to  
> heprodop.
> Since the cookie had the second factor, they would be accepted at
> heprodop and not be prompted to provide the token again.

Yes, that's exactly right.

:wes