Compatibility with Microsoft Entra multifactor authentication external method provider

[nicolaspernoud]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

No response

Describe your problem

Hello, and thanks for this product !

Is it compatible with "Microsoft Entra multifactor authentication external method provider" (https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-external-method-provider) ?
The use case is to delegate the checking of another factor to the Idp, while using Entra Id as main IdP.

For this to work, there would be a few requirements :

• implement the implicit flow, or at least the id_token response type : https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-external-method-provider#microsoft-entra-id-call-to-the-external-identity-provider ;
• parse the id_token_hint provided by entra id : https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-external-method-provider#example-of-an-id_token_hint ;
• provide an id_token that must be an mfa token : https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-external-method-provider#example-of-an-eam-that-satisfies-mfa ;
• be extensible to integrate custom authentication methods.

Describe your ideal solution

Support built in the product

Workarounds or alternatives

Other products

Version

no version for now

Additional Context

No response

[aeneasr]

Ory Hydra supports ID Token implicit flow and since you can set your own claims in the ID Token I don’t see a reason why it would not be possible with some tinkering!