ELIXIR and ORCID MFA

FIM4R Assurance 17 Jun 2021

​

Mikael Linden, ELIXIR AAI task

www.elixir-europe.org

General approach

1. Ask if HO can do MFA
2. If no, invoke local MFA/Step-up
• TOTP
• WebAuthN

​

​

See documentation here.

ELIXIR AAI

Proxy IdP/SP

ELIXIR MFA

Home

university

ORCID.org

Relying service

1. ​

2.

ORCID MFA

• ORCID.org delivers information if the user did MFA at ORCID
• “amr”: ”mfa”
• Requires ORCID membership (member API)
• references
• https://info.orcid.org/faq/does-orcid-support-two-factor-authentication/
• https://support.orcid.org/hc/en-us/articles/360006971673
• https://trello.com/c/9LVa7TqK/146-add-amr-to-idtoken-so-integrations-know-if-someone-used-2fa-3