Last updated: 2 September 2026

Overview

Service Providers (SPs) can use a signal defined within the REFEDS MFA Profile to request multi-factor authentication (MFA) from an Identity Provider (IdP).

Not all Identity Providers (IdPs) within AAF currently support signalling MFA.

The IdP responds to the SP’s request by ensuring that the user is authenticated using MFA. If the user is not authenticated using MFA, the IdP will return an error message to the SP.

This tutorial will guide you through the process of configuring a Shibboleth Service Provider (SP) to use the REFEDS MFA Profile for MFA.

What you’ll learn

• How to request REFEDS MFA
• Error handling

What you’ll need

• To have integrated your application with the SAML protocol
• To have connected your service with AAF using SAML

An overview of the steps involved in signaling the MFA requirement by an SP and the response by an IdP is shown below:

Figure 1. REFEDS MFA signaling and response