A common multi factor authentication solution will ask a user for a username+password and a one-time password.

In all documents I can find both factors are asked by the same identity provider. This can be the website itself or for example when it supports 'Login with Google' it can be Google who also asks for an OTP.

On our website users can authenticate with SAML against their corporate active directory.
We are considering adding a second factor like TOTP in our application. That way the first factor would be the SAML authentication and the second factor authentication would come from our website.

Somehow this feels weird to me. Is this a brilliant solution or a bad (insecure) plan?

  • 1
    I would not call it "splitting two factor" but instead adding another authentication layer. Of course it can make sense and it is not that uncommon - for example first connecting via VPN into the company network and then logging into the mail server is a similar concept. 2FA/MFA is not the same though: it is having multiple steps for a single user while with different identity providers these are actually multiple users, only maybe synchronized between the identity providers. Commented Apr 15, 2021 at 19:29

2 Answers 2


Authentication with SAML uses password in the corporate directory. This password is one authentication factor. The TOTP uses key (password) that has nothing to do with password in the corporate directory. Thus these are two independent factors. For authentication an attacker will need to know both.

Both factors are based on the knowledge of some secret. Normally it is better to use factors of different types, e.g. one is based on knowing of something and one based on possessing of something (like token, card, smartphone) or being something (like fingerprint).

But in the reality TOTP does not require user to enter the key each time. Usually the key is generated randomly and stored in the device, e.g. in the token. This token generates codes based on the key and current time. To compromise this factor often it is easier to compromise the token (e.g. steal it) than to extract the key from it or to retrieve the key from the security system. Thus the security of TOTP is based effectively not on the knowledge of the key, but on the possession of the token.

Thus 2FA in your case is based on knowledge (of the password in corporate directory) and possession (of the TOTP hardware token).

This approach is reasonable and is more or less common. Of course the real strength of the security depends on many things:

  • The entropy of the passwords in the corporate directory (if it is low, such passwords can be easier brute-forced)
  • How is password management implemented in your company (e.g. how is allowed to reset passwords for users, in what cases)
  • How is TOTP organized (e.g. who can get access to the TOTP key on the server side)
  • How disciplined are users (if they keep their passwords secret or write them down and make then accessible to the others)
  • How well user care of TOTP tokens (e.g. to they inform your company immediately as they notice that token is lost/stolen)
  • Etc.

But the approach itself is reasonable.

  • I feel like this doesn't really answer his OPs question. You're saying what 2FA is and that it's reasonable. He's asking if he should implement the 2FA on his side (SP) or not.
    – Andrew K.
    Commented Apr 16, 2021 at 14:47
  • @AndrewK.: The OP asked Is this a brilliant solution or a bad (insecure) plan? I answered: This approach is reasonable. Why do you think the OPs question is not answered? And I found that explanation was needed, because the OPs shows doubt in the purpose of such scheme, quote: Somehow this feels weird to me. I explained why it is not weir, but makes sense.
    – mentallurg
    Commented Apr 16, 2021 at 21:01
  • This is answer enough for me: my question was mostly meant to get some thoughts, which i got.
    – Jeff
    Commented Apr 19, 2021 at 20:08

Tacking an additional layer of authentication onto a process generally isn't a bad idea, in and of itself.

That having been said, I posit that you're not aware (as the SP) what steps that a user has already gone through to get to your application. What if they have already gone through a round of MFA on the IdP side? You're going to ask again, and that's likely a bad user experience.

If you believe that the service you provide is critical enough to protect with MFA, I would offer that as an option to your IdP partners. Tell them that you require MFA to have occurred, and if they aren't doing that or capable of doing that, then you'll provide it for their users.

  • It is not me who thinks our website needs 2FA: companies that are using our website (subscription based) are asking for it on top of their SAML login. But I understand your point.
    – Jeff
    Commented Apr 19, 2021 at 20:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .