Tutorial 2: Passwords, MFA, and Federation

Unit 3 ยท Identity and access management

Objectives

Authentication factors include knowledge, possession, and inherence. MFA reduces password-only risk, but recovery channels, phishing, push fatigue, and session theft remain important. Federation lets one identity provider issue assertions or tokens accepted by relying services under an explicit trust relationship.

identity provider -> authenticated assertion -> relying party
relying party -> validate issuer, audience, expiry, signature -> session

Password policy should favor long unique passwords, breached-password screening, slow hashing, rate limits, and password managers. Federation validation must check issuer, audience, signature, expiry, nonce or state, and intended redirect.

Exercises

  1. Compare TOTP, security keys, and push MFA against phishing.
  2. List claims a relying party must validate.
  3. Design a lost-device recovery flow.

Self-check

  1. What is federation?
  2. Why is recovery security-critical?
  3. What does audience validation prevent?

Self-Check Quiz

1. Does MFA eliminate phishing?

AnswerNo. It raises the bar; phishing-resistant security keys and careful recovery reduce risk more effectively than weak approval prompts.

2. Why validate an assertion's audience?

AnswerTo ensure the assertion was intended for this relying service rather than another service.

Homework

  1. Design enterprise login with federation and MFA.
  2. Document token validation and session creation.
  3. Threat-model account recovery.
Sample answerValidate issuer, signature, audience, expiry, nonce/state, and required claims before creating a limited session. Recovery should require independent verified factors, notify the user, expire temporary access, and create an audit trail.