Introduction

Any service that is connect to SURFconext can use SURFsecureID to handle its strong authentication. When a services uses SURFsecureID, the login process will not only perform the first factor – username/password at the institution's Identity Provider (IdP) – but also the second factor as chosen by the end user. The strong authentication requirement can be enforced based on policies: user attributes, ip range or group memebership.

The service connects to SURFconext

Many services are already connected to SURFconext or can easily make such a connection. The service provider or the institution consuming the service can determine that strong authentication is needed for accessing the service. Enabling SURFsecureID can be done by the SURFconext-responsible person ("SURFconext-verantwoordelijke") from the institution in the SURFconext Dashboard by going to the specific service, go to the Settings → SURFsecureID tab and select an appropriate Level-of-assurance. The institution or service provider do not need to make any changes to their implementations.

Note that:

  • The service can connect with SAML or OpenID Connect to SURFconext, both will work
  • A step-up policy can be configured in SURFconext that determines for which persons SURFsecureID is called. This can be configured based on user-attributes or IP address. See option 2 on this page.
  • This integration also supports dynamic LoA request by the service.

Authentication flow

  1. The SP sends a SAML 2.0 AuthnRequest or an OpenID Connect request to SURFconext.
  2. The user chooses the Identity Provider (institution) where to login for the 1st factor and SURFconext sends this IdP a SAML AuthnRequest
  3. The user logs in at the IdP and a SAML response is sent back to SURFconext with the identity and attributes of the user
  4. In this case, SURFconext is configured for this SP or SP-IdP combination to call SURFsecureID with a minimum LoA (>1).
  5. SURFsecureID gateway sends the user to the authentication provider for the 2nd factor
  6. The 2nd factor authentication provider returns the response to the SURFsecureID gateway.
  7. The SURFsecureID gateway sends a SAML Response back to SURFconext
  8. SURFconext sends a SAML or OpenID Connect Response with the attributes and the identity of the user to the SP.

For the SP only steps 1 and 8 are visible.