Describe how users authenticate to your application. Do you support MFA and SSO? What SSO protocols are supported (SAML, OIDC)?

Understanding the Question

This question is asking you to detail the methods your application uses to verify the identity of its users. Authentication is the process of confirming that a user is who they claim to be. The question specifically wants to know if your application supports Multi-Factor Authentication (MFA) and Single Sign-On (SSO). MFA requires users to provide two or more verification factors to gain access, adding an extra layer of security. SSO allows users to authenticate once and gain access to multiple applications without needing to log in again. The question also asks which SSO protocols your application supports, such as Security Assertion Markup Language (SAML) or OpenID Connect (OIDC). These protocols are standards for secure authentication.

Why It Matters

Understanding how users authenticate to your application is crucial for assessing its security posture. MFA significantly reduces the risk of unauthorized access because even if an attacker obtains a user's password, they would still need additional verification factors. SSO enhances user experience by simplifying the login process while maintaining security through standardized protocols like SAML and OIDC. These protocols ensure that authentication data is securely transmitted and verified across different systems.

Example of Evidence

To demonstrate fulfillment of this question, you might provide documentation or configuration settings that show your application supports MFA and SSO. For instance, you could show configuration files or screenshots from your authentication system that list supported protocols (SAML, OIDC) and describe the MFA methods available (e.g., SMS codes, authenticator apps). Additionally, you might include logs or reports that show MFA and SSO usage statistics, indicating that these features are actively being used by your users.