{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/Thinktecture.IdentityServer3/issues/626","labels_url":"https://api.github.com/repos/IdentityServer/Thinktecture.IdentityServer3/issues/626/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/Thinktecture.IdentityServer3/issues/626/comments","events_url":"https://api.github.com/repos/IdentityServer/Thinktecture.IdentityServer3/issues/626/events","html_url":"https://github.com/IdentityServer/Thinktecture.IdentityServer3/issues/626","id":51692839,"number":626,"title":"Require 2-Factor for certain areas","user":{"login":"aosgo","id":9867956,"avatar_url":"https://avatars.githubusercontent.com/u/9867956?v=3","gravatar_id":"","url":"https://api.github.com/users/aosgo","html_url":"https://github.com/aosgo","followers_url":"https://api.github.com/users/aosgo/followers","following_url":"https://api.github.com/users/aosgo/following{/other_user}","gists_url":"https://api.github.com/users/aosgo/gists{/gist_id}","starred_url":"https://api.github.com/users/aosgo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aosgo/subscriptions","organizations_url":"https://api.github.com/users/aosgo/orgs","repos_url":"https://api.github.com/users/aosgo/repos","events_url":"https://api.github.com/users/aosgo/events{/privacy}","received_events_url":"https://api.github.com/users/aosgo/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/IdentityServer/Thinktecture.IdentityServer3/labels/question","name":"question","color":"cc317c"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2014-12-11T14:31:36Z","updated_at":"2015-02-05T15:00:11Z","closed_at":"2014-12-16T14:23:51Z","body":"Hi,\r\nIs it possible to for example require two-factor for certain areas of an application? Ideally we'd like to do the following:\r\n\r\n* User logs in using IdSrv with username and password\r\n* User navigates around an application\r\n* User hits a \"highly sensitive\" resource or action\r\n* User taken back to IdSrv and prompted to reenter their password again plus a pin from a text message (or HMAC derived code)\r\n* 2-Factor is validated, and user claims are updated to reflect they auth'd using 2-factor - maybe their AuthenticationMethod is changed to \"2fa\"\r\n* User is allowed into the \"highly sensitive\" resource action\r\n* User continues to navigate around application\r\n* User hits another \"highly sensitive\" resource action\r\n* Application can see they've already authenticated using 2-factor again the AuthenticationMethod maybe shows as \"2fa\"\r\n* User is allowed into the \"highly sensitive\" resource action\r\n\r\nWe have our own IUserService implementation, so we could from the start ask for 2-factor (or give the option to the user to do this from the start), but not sure how we can update their original identity token and claims to reflect they have since logged in using 2fa if we bounce them back to a 2-factor page without making them loging again fully and getting a new token - how can we change their AuthenticationMethod  during a session (and maybe add a few more claims)?\r\n\r\nThanks for all your hard work on IdSrv (and the supporting applications) - it is appreciated.\r\n\r\nMany Thanks"},"comment":{"url":"https://api.github.com/repos/IdentityServer/Thinktecture.IdentityServer3/issues/comments/73059752","html_url":"https://github.com/IdentityServer/Thinktecture.IdentityServer3/issues/626#issuecomment-73059752","issue_url":"https://api.github.com/repos/IdentityServer/Thinktecture.IdentityServer3/issues/626","id":73059752,"user":{"login":"brockallen","id":649492,"avatar_url":"https://avatars.githubusercontent.com/u/649492?v=3","gravatar_id":"","url":"https://api.github.com/users/brockallen","html_url":"https://github.com/brockallen","followers_url":"https://api.github.com/users/brockallen/followers","following_url":"https://api.github.com/users/brockallen/following{/other_user}","gists_url":"https://api.github.com/users/brockallen/gists{/gist_id}","starred_url":"https://api.github.com/users/brockallen/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brockallen/subscriptions","organizations_url":"https://api.github.com/users/brockallen/orgs","repos_url":"https://api.github.com/users/brockallen/repos","events_url":"https://api.github.com/users/brockallen/events{/privacy}","received_events_url":"https://api.github.com/users/brockallen/received_events","type":"User","site_admin":false},"created_at":"2015-02-05T15:00:11Z","updated_at":"2015-02-05T15:00:11Z","body":"@johnkors no, not really"}}