Compatibility with Microsoft Entra multifactor authentication external method provider

[nicolaspernoud]

Hello, and thanks for this product !

Is it compatible with "Microsoft Entra multifactor authentication external method provider" (https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-external-method-provider) ?
The use case is to delegate the checking of another factor to the Idp, while using Entra Id as main IdP.

For this to work, there would be a few requirements :

• implement the implicit flow, or at least the id_token response type : https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-external-method-provider#microsoft-entra-id-call-to-the-external-identity-provider ;
• parse the id_token_hint provided by entra id : https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-external-method-provider#example-of-an-id_token_hint ;
• provide an id_token that must be an mfa token : https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-external-method-provider#example-of-an-eam-that-satisfies-mfa ;
• be extensible to integrate custom authentication methods.

[vinckr]

Hello @nicolaspernoud
did you have a look at Ory Kratos? As far as I can tell this is already possible with Ory Kratos (except custom auth methods, but I am not sure how that is related?)

[nicolaspernoud]

Exactly, the full workflow can be found here : https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-external-method-provider .
The point would be to have an external auth provider that should be customizable enough to have a custom factor, for example the ip address geolocation, of the presence of a VPN, etc.

[vinckr]

Hello @nicolaspernoud

I see.

The point would be to have an external auth provider that should be customizable enough to have a custom factor, for example the ip address geolocation, of the presence of a VPN, etc.

You can already implement this behaviour in Ory Kratos via Ory Actions: https://www.ory.sh/docs/guides/integrate-with-ory-cloud-through-webhooks

Here is an example for VPN detection with Ory Actions: https://github.com/ory/examples/tree/master/ory-actions/vpncheck-py

Ory Network also gives you a devices object as part of the session that includes geolocation, IP address etc. so you can use those in Ory Actions. This is not directly implemented in Ory Kratos, but a proprietary feature.

Is this what you are looking for?

[nicolaspernoud]

That could be kind of what I am looking for : are Ory Actions part of the community version ?

[vinckr]

Yes you can use Ory Actions when self-hosting the OSS version of Ory Kratos.

[nicolaspernoud]

Thanks, I'll have a look !