3 ms·

> Context Aware Access checks on every SSO It's only available in the Enterprise plan levels. > I don't know what you mean here but I'm curious if you wouldn'

> Context Aware Access checks on every SSO It's only available in the Enterprise plan levels. > I don't know what you mean here but I'm curious if you wouldn't mind? Using the prior example where GSuite is my IDP. If I want to require an MFA check before granting access to AWS SSO - I've got no way of doing this. CAA might help, but if I want to be explicit "Hey, this has access to customer data - we're always going to do an MFA check on this access", there's no good way of doing this. Using an intermediary like Okta would allow you to do that additional level of checking. e: To be clear, I'm using AWS SSO as the destination application as an example. There's other applications that you might want to control access to that also have particularly sensitive data where you want to re-verify that someone else hasn't just walked past an unlocked laptop and decided to poke around.

insanitybit 3y ago
> It's only available in the Enterprise plan levels. It can be bought separately for Business iirc. > there's no good way of doing this. Through GSuite, agreed. But you could just configure the 2FA for the downstream service, no? That's what we did at my company. > There's other applications that you might want to control access to that also have particularly sensitive data where you want to re-verify that someone else hasn't just walked past an unlocked laptop and decided to poke around. For sure, I'm not trying to argue or debate or anything, was just curious.
- paranoidrobot 3y ago
  > But you could just configure the 2FA for the downstream service, no? Only if the downstream service supports it. Lots don't, or at least don't enforce it when you come in via SSO. AWS SSO being the one I keep coming back to, because it bugs me so much. For those that do, you now have to also manage the 2FA tokens with that service, using whatever they support. Often that's SMS based 2FA, or maybe TOTP, or their own custom TOTP/Push. Maybe they support FIDO2, but only a single FIDO2 key.
  - insanitybit 3y ago
    Yeah makes sense, thanks. I think I'm fine with a 2FA on GSuite login + CAA on subsequent SSOs but I do think it would be nice to be able to force another 2FA for sensitive stuff like AWS. Unfortunately, GSuite seems to move very slowly :\

insanitybit 3y ago

> It's only available in the Enterprise plan levels. It can be bought separately for Business iirc. > there's no good way of doing this. Through GSuite, agreed. But you could just configure the 2FA for the downstream service, no? That's what we did at my company. > There's other applications that you might want to control access to that also have particularly sensitive data where you want to re-verify that someone else hasn't just walked past an unlocked laptop and decided to poke around. For sure, I'm not trying to argue or debate or anything, was just curious.

paranoidrobot 3y ago
> But you could just configure the 2FA for the downstream service, no? Only if the downstream service supports it. Lots don't, or at least don't enforce it when you come in via SSO. AWS SSO being the one I keep coming back to, because it bugs me so much. For those that do, you now have to also manage the 2FA tokens with that service, using whatever they support. Often that's SMS based 2FA, or maybe TOTP, or their own custom TOTP/Push. Maybe they support FIDO2, but only a single FIDO2 key.
- insanitybit 3y ago
  Yeah makes sense, thanks. I think I'm fine with a 2FA on GSuite login + CAA on subsequent SSOs but I do think it would be nice to be able to force another 2FA for sensitive stuff like AWS. Unfortunately, GSuite seems to move very slowly :\