I have an application that is a SAML SP, authenticating users via inbound SAML assertions from some other IdP.
If I want to require multi-factor auth, is it a common practice to add multi-factor auth on the SAML SP side, on top of validating the incoming SAML assertion? Or is it more typical to expect MFA to be implemented in the SAML IdP where the user is directly authenticated?
And is there a standard way to tell whether a user with authenticated with MFA or username/password alone by looking at the claims in the SAML assertion? Or does this depend on the exact IdP implementation?