adfsmfa credential provider

[DrArmaggedon]

Hi guys,
Awesome project, wonder if there is any credential provider available to secure windows login via adfsmfa? any suggestion?

[DrArmaggedon]

I have played with a couple of Credential Providers this week and it looks totally doable I think. Is there any direct API to adfsmfa for authentication?

[redhook62]

There is no usable API in adfsmfa (for security reasons).
Indeed, it would be possible to implement one (for TOTP codes ?)
Can you clarify your vision ? how could this be ?

[DrArmaggedon]

Well may be the ADFS should help, will check it out soon. But due my previous experiences regarding Credential Provider, It would be much more simpler to use LDAP for password check and a simple interactive API (may be a single REST method) for challenge/response verification. (TOTP, FIDO2 ...). Let me check the code and see if I can do anything about it. The major problem is that I'm not much a MS guy so it may slow me down!

[redhook62]

It's still not very clear to me.

Yes, it is possible on ADFS to create a "Credential Provider", A "Primary authentication provider",
for example to replace the password entry.

This does not concern MFA, ADFSMFA does not have an API to validate a TOTP or FIDO2 code.
As stated, this is for security reasons, however, it's something that can be considered given those constraints.

Basically, what do you want to do? from which workstation do you want to implement this?
On Windows, there is already what is needed for biometrics for example.
Do you want to replace the login system of the operating system (msgina)?

Can you tell us the links of the credential providers that you have tested?