Multi-Factor Interactive User Login Use Case

Actors

1. User
2. System

Pre-Conditions

1. System is configured to process multiple forms of credentials simultaneously
2. System has policies configured for various multi-factor scenarios
3. System may have configured policy for service
4. System has a default policy for when none are configured for a particular service
5. User is attempting to access a particular service

Flow

1. User attempts to access a service and is sent to the System for Authentication
2. If User has previously authenticated, system attempts to grant access and checks whether existing Authentication satisfies policy. Policy types are defined under Business Rules
3. If Authentication satisfies policy, user is allowed access to service
4. If User has no existing session or existing session does not satisfy policy, user is notified of credentials that will satisfy policy
5. User Credentials are authenticated and confirmed to meet policy requirements
6. If authentication fails, user is required to provide credentials again to be validated.

Post-Conditions

1. On Successful Authentication, user is redirected back to service. Successful Authentication means the credentials were valid AND the policy was satisfied.

Business Rules

1. Policy are defined as the following:
   1. A Particular Form of Authentication is Required
   2. A Particular Set of Authentications is Required (Ordered or Unordered)
   3. A Particular Level Must be Met (while policies may be configured per service, level definitions are global)
   4. A Particular Group Must be Satisfied (i.e. X or more from Authn A, B,C)
   5. Custom Logic
   6. Any

Non-Functional Requirements

• None