https://www.ory.sh/ logo
Join Slack
Powered by
Hello, I was able to implement a step-up MFA flow ...
# general
d
Hello, I was able to implement a step-up MFA flow by following the suggestions of the Trigger Dynamic Multi-Factor authentication part of Ory's documentation. However, we do not wish to keep the session in an elevated AAL2 state for more than a period of time (e.g. 5 minutes), and would like to automatically step-down back to AAL1. 1. Is there a way to achieve this natively with Ory? EDIT: It seems I'm trying to implement a GitHub-like sudo mode where the AAL2 drops down to AAL1 after a timeout, where later privileged actions will require "stepping-up" again to AAL2 via a flow (like SMS / TOTP / etc). Thank you!
m
What should happen when you do the step-down? You could check authenticated_at and if it is 5 minutes ago trigger another aal2 auth with 
?refresh=true&aal=aal2
d
The step-down should make the session's aal go back to aal1. -- Otherwise put, we don't want to keep the session at aal2 for the rest of the session's lifetime. -- The stepup to aal2 should be temporary (e.g. expires after 5 minutes), and/or could be manually stepped-down by the server after a sensitive action has been actioned.
iirc, I also tried to do a 
?refresh=true&aal=aal1
in an effort to "downgrade" the session, but the previous 
aal2
still evaluates the session overall as 
aal2
.
I just found the Privileged sessions section of the documentation, found the 
privileged_session_max_age
property in my identity-config and attempted to change it to something very short (
30s
) to test it. However, my session's 
"authenticator_assurance_level"
stayed at 
"aal2"
after stepping up and waiting for the timeout. However, I noticed that this 
privileged_session_max_age
is only available as part of the 
settings
flow config (
.flows.settings.privileged_session_max_age
) so I may not have worked as I intended. I tried to apply the same property to 
flows.login.privileged_session_max_age
however the config fails to write with a validation error that additionalProperties 
privileged_session_max_age
is not allowed. As referenced in your docs, I am trying to implement a GitHub styled Sudo mode -- but would like a similar 
privileged_session_max_age
for all sessions whenever they become "privileged".
3 Views
Open in Slack
PreviousNext
Powered by