identityServer4 with Login Step-up and MFA

Question

In one of my Projects i need to implement Login Step-up. That means a user can login an application with simple username and password to get some readonly access access on website and API behind it.

If user want to performan any sensetive data operations like "write/update", he need to authenticate via second factor (via SMS code).

second factor login is for maximum 10 minutes valid, if user does not interect the website for 10 minuets, he will be automatically logout from second factor, but he still remain logged in with one factor.

can identityserver4 support this szenario out of the box? or do i need to implement it by my own ?

Here is my solution proposal:

• for one factor login, identityserver provide a one factor scope, which client need to understand. it provide a access token which also have limited scope.
• when client application need two factor scope, it call identityserver again where user must provide second factor authentication. hence a new token with second factor scope sent back to client. with this token client can call API methodes which need second factor authentication.
• second factor authentication token has a validity of 10 minutes
• after 10 min token is invalid, but one factor token is still valid as it has long life time.

Questions:

- Can IdentityServer4 offer Login Step-up out-of-box? if no, what are the alternative solutions ?

what is your suggesstion regarding my solution proposal?

Thanks in Advance

Answer 1

What you wrote in the bullet points is basically how I'd see it implemented in IdentityServer4. It's just setting up two different scopes and issuing two separate tokens for the same user. First scope 'readonly', lifetime=24h, acceptable only by safe operations in the application api, second scope 'full' with lifetime=10mins acceptable by all operations. No big problem, it should be perfectly doable with basic IdentityServer4. However, you will have to RT(F)M and configure the scopes, clients, tokens, etc. in the IdentityServer4 config. And also, you'll have to implement the two-token access policies in your app's backend api implementation, and of course client apps will have to be careful about which token they obtain and which token they use for which backend call.. but all of that is more-or-less obvious (and you seem to understand that, judging from that bullet points) so I don't quite see what you'd want by saying "out of the box" or what are you worried about in terms of support for that on the IdentityServer4 side..