pgkiln 0.65.0 → 0.66.0

package/db/migrations/134_idp_mfa.sql

@@ -0,0 +1,46 @@
+-- ---------------------------------------------------------------------
+-- 134: make sure an identity provider really did multi-factor sign-in
+-- (sprint 132, SEC-4; beyond APEX, which trusts the IdP's sign-on policy).
+--
+-- meta.auth_provider:
+--   mfa_required       refuse a sign-in (to applications and to the builder)
+--                      unless the provider says it asked for a second factor:
+--                      OpenID Connect through the ID token's amr or acr claim,
+--                      SAML through the assertion's AuthnContextClassRef.
+--   mfa_request        what to ask the provider for, space separated: OpenID
+--                      Connect acr_values, or SAML AuthnContextClassRef values
+--                      (a RequestedAuthnContext). null: ask for nothing.
+--   mfa_values         the amr / acr / AuthnContextClassRef values that count
+--                      as a second factor (any one of them is enough).
+--   local_second_step  after a sign-in through this provider, pgkiln asks its
+--                      own second step as after a password (the application's
+--                      two-step rule; the developer's factor for the builder),
+--                      for providers that cannot enforce MFA themselves.
+--
+-- meta.sso_pending.stepup_session: a step-up through the provider (an
+-- authorization scheme with mfa_minutes, 133): the signed-in session the
+-- provider's fresh multi-factor sign-in confirms. The provider is asked to
+-- sign the user in again (prompt=login / max_age=0, SAML ForceAuthn).
+-- ---------------------------------------------------------------------
+alter table meta.auth_provider
+  add column mfa_required      boolean not null default false,
+  add column mfa_request       text check (length(mfa_request) <= 500),
+  add column mfa_values        text[] not null default array[
+    'mfa',
+    'http://schemas.microsoft.com/claims/multipleauthn',
+    'urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract',
+    'urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorUnregistered'],
+  add column local_second_step boolean not null default false;
+comment on column meta.auth_provider.mfa_required is
+  'Refuse sign-ins the provider does not mark as multi-factor (amr / acr, SAML AuthnContextClassRef; 134).';
+comment on column meta.auth_provider.mfa_request is
+  'acr_values (OpenID Connect) or AuthnContextClassRef values (SAML) to request, space separated (134).';
+comment on column meta.auth_provider.mfa_values is
+  'amr / acr / AuthnContextClassRef values that count as a second factor (134).';
+comment on column meta.auth_provider.local_second_step is
+  'After a sign-in through this provider, pgkiln asks its own second step too (134).';
+
+alter table meta.sso_pending
+  add column stepup_session uuid references meta.session (id) on delete cascade;
+comment on column meta.sso_pending.stepup_session is
+  'A step-up through the provider: the signed-in session it confirms (134).';

package/docs/apex-feature-parity.md

@@ -138,7 +138,7 @@ the 26.2 comparison.)
 | APEX accounts | ✅ | Instance-wide user directory, bcrypt, session rotation, idle and absolute timeouts |
 | Application Access Control (roles per app, any-user switch) | ✅ | Access control per application |
 | Social sign-in / OpenID Connect | ✅ | Any OIDC provider (Entra ID, Google, Okta, Keycloak, …): PKCE, group → role mapping, account linking, automatic accounts |
-| Multi-factor authentication | ✅ | As in APEX: through the identity provider (OpenID Connect, SAML). Beyond APEX (sprints 126–128): the builder itself has two-factor sign-in with passkeys (WebAuthn, also on their own without a password), authenticator apps (TOTP) and recovery codes, trusted browsers, an instance and per-workspace policy with a grace period and lockout recovery ([chapter 3](guide/03-builder.md#two-factor-sign-in)). Sprint 130: application users too, per application (off, optional, required, required for roles) with authenticator apps and recovery codes, added while signing in or on My account, reset from Users; sprint 131: passkeys, e-mail codes as a fallback, step-up per authorization scheme and REST API tokens only after a second step ([chapter 8](guide/08-security.md#two-factor-sign-in)) |
+| Multi-factor authentication | ✅ | As in APEX: through the identity provider (OpenID Connect, SAML). Beyond APEX (sprints 126–128): the builder itself has two-factor sign-in with passkeys (WebAuthn, also on their own without a password), authenticator apps (TOTP) and recovery codes, trusted browsers, an instance and per-workspace policy with a grace period and lockout recovery ([chapter 3](guide/03-builder.md#two-factor-sign-in)). Sprint 130: application users too, per application (off, optional, required, required for roles) with authenticator apps and recovery codes, added while signing in or on My account, reset from Users; sprint 131: passkeys, e-mail codes as a fallback, step-up per authorization scheme and REST API tokens only after a second step ([chapter 8](guide/08-security.md#two-factor-sign-in)). Sprint 132: pgkiln checks that the identity provider did multi-factor sign-in (`amr` / `acr`, SAML `AuthnContextClassRef`), requests it, steps up through the provider, or asks its own second step after it ([chapter 8](guide/08-security.md#multi-factor-sign-in-at-the-identity-provider)) |
 | Change own password | ✅ | A built-in *My account* page (APEX offers the API `CHANGE_CURRENT_USER_PW`) |
 | Password expiry, change on first use, admin reset, complexity | ✅ | Lifetime in days, expire/unexpire, admin reset, length and letters+digits rules, unlock |
 | Lockout after failed sign-ins | ✅ | Per user and per IP, time-based (APEX: until an administrator unlocks) |
@@ -305,6 +305,10 @@ Small but real differences, for teams comparing the two:
   before sensitive pages (an authorization scheme's *Second step within*) and REST API tokens only after a second step
   ([chapter 8](guide/08-security.md#two-factor-sign-in)).
   APEX's application authentication schemes have no second factor.
+- (sprint 132) **Proof that the identity provider did multi-factor sign-in**: a provider can be required to say so in
+  the ID token's `amr` / `acr` or the SAML `AuthnContextClassRef`, step-up goes back to it for a fresh multi-factor
+  sign-in, and pgkiln's own second step can follow a provider that cannot enforce MFA
+  ([chapter 8](guide/08-security.md#multi-factor-sign-in-at-the-identity-provider)). APEX trusts the provider's policy.
 - One RLS policy set protects both the web UI and the REST API.
 - An import can be checked before it commits (`pgkiln import --check`): SQL that names a missing
   table or column refuses the deployment instead of failing at run time.

package/docs/guide/03-builder.md

@@ -138,7 +138,11 @@ started it (in the same browser). The region lists linked identities, with **Unl
 developers linked to it; administrators unlink any of them.
 
 Signing in through a provider skips pgkiln's own second step and the enrolment on Security: the provider decides on
-the second factor. A directory checks a password, so pgkiln's second step follows as with the pgkiln password.
+the second factor. (0.66) The provider's *Require multi-factor sign-in at this provider* makes pgkiln check that it
+did (the ID token's `amr` / `acr`, SAML's `AuthnContextClassRef`) and refuse the sign-in otherwise; *Ask pgkiln's own
+second step after this provider* makes a developer with a second factor give it after the provider too
+([chapter 8](08-security.md#multi-factor-sign-in-at-the-identity-provider)). A directory checks a password, so
+pgkiln's second step follows as with the pgkiln password.
 
 **Requiring it per workspace.** A workspace's page (*Preferences* → *Single sign-on*) has *This workspace's
 developers must sign in through an identity provider* (or a directory). Its developers' pgkiln password and a passkey

package/docs/guide/08-security.md

@@ -244,6 +244,40 @@ psql "$DATABASE_URL" -f examples/keycloak-saml.sql    # reads Keycloak's signing
 
 The HR login page then offers *Sign in with Keycloak (SAML)*, with the same Keycloak users.
 
+### Multi-factor sign-in at the identity provider
+
+With single sign-on the provider asks for the second factor, in its own sign-on policy (Entra ID Conditional Access,
+Okta and Keycloak authentication flows, OCI IAM sign-on policies). APEX trusts that policy blindly; pgkiln (0.66) can
+check that the provider really did it. On the provider (**Users → Identity providers**), under *Multi-factor sign-in*:
+
+| Field | Meaning |
+|---|---|
+| Require multi-factor sign-in at this provider | Refuse every sign-in through this provider, to applications and to the builder, that the provider does not mark as multi-factor. The user sees *The identity provider did not confirm a second factor*; the Activity monitor logs it as a failed sign-in |
+| Ask the provider for | Sent with every sign-in: OpenID Connect `acr_values`, or SAML `AuthnContextClassRef` values (a `RequestedAuthnContext`, comparison *exact*), separated by spaces. Empty: nothing is asked for |
+| Values that mean multi-factor | The values that count, separated by spaces; any one is enough. OpenID Connect: an entry of the ID token's `amr` claim (RFC 8176) or its `acr`. SAML: the assertion's `AuthnContextClassRef` |
+| Ask pgkiln's own second step after this provider | For providers that cannot require MFA themselves: see below |
+
+The default values are `mfa` (Entra ID, Okta and Auth0 put it in `amr` after a second factor), Entra ID's SAML
+`http://schemas.microsoft.com/claims/multipleauthn`, and SAML's `MobileTwoFactorContract` and
+`MobileTwoFactorUnregistered`. For Keycloak, name the level of your step-up flow (for example request and accept
+`gold`, or `2` with the default level-of-authentication mapping); for a SAML IdP, the class it sends after a second
+factor. Without *Require*, a provider that does say `mfa` still counts: the session then has a recent second step for
+[step-up](#asking-again-before-a-sensitive-page-step-up), and the Activity monitor shows `sso:<provider> (mfa)`.
+
+**Step-up through the provider.** A user who signed in through a provider and opens a page behind an authorization
+scheme with *Second step within (minutes)* goes back to that provider, which is asked to sign them in again
+(OpenID Connect `prompt=login` and `max_age=0`; SAML `ForceAuthn`) with the requested context. The answer must carry
+one of the multi-factor values, a sign-in time (`auth_time`, or the SAML `AuthnInstant`) of the last ten minutes,
+and the identity already linked to the signed-in account; nothing is created or linked on the way. The page then
+opens.
+
+**pgkiln's own second step after the provider.** With *Ask pgkiln's own second step after this provider* on, a sign-in
+through the provider is followed by the application's [two-factor rule](#two-factor-sign-in) exactly as after a
+password (users add an app or a passkey on *My account*, or while signing in when the application requires one), and
+step-up asks for that factor instead of going back to the provider. For the builder, a developer with a second factor
+gives it after the provider; one without is treated like a password sign-in, so a two-factor rule of the instance or
+workspace makes them add one.
+
 ### LDAP and Active Directory
 
 Applications can check passwords against **LDAP directories** (OpenLDAP, Active Directory,
@@ -426,7 +460,8 @@ sign-on policy asks for one, or a hand-written TOTP check in a custom authentica
 How it works:
 
 - The second step follows the user directory's **password** and **LDAP** directories. An identity provider
-  ([OpenID Connect](#single-sign-on-openid-connect), [SAML](#single-sign-on-saml-20)) asks for its own second factor;
+  ([OpenID Connect](#single-sign-on-openid-connect), [SAML](#single-sign-on-saml-20)) asks for its own second factor,
+  which pgkiln can [check](#multi-factor-sign-in-at-the-identity-provider), or leaves it to pgkiln's second step;
   database accounts, custom authentication and HTTP header authentication are not covered.
 - The code comes from any authenticator app (TOTP, RFC 6238: Google Authenticator, Microsoft Authenticator,
   1Password …), each code once, one 30-second step either side for clock drift. A **recovery code** (ten per account,
@@ -472,7 +507,9 @@ An authorization scheme's **Second step within (minutes)** makes it pass only wh
 the scheme otherwise to *Confirm it's you* (the second-step page) and back to the page afterwards; regions, buttons and
 processes behind it stay hidden or skipped until then. A user without a factor is told to add one on *My account*.
 Typical: `SALARY_EDIT` (role `hr_manager`, second step within 15 minutes) on the page that changes salaries. A
-*Keep me signed in*, shared or single sign-on session has no recent second step of pgkiln's own, so it is asked too.
+*Keep me signed in* or shared session has no recent second step of pgkiln's own, so it is asked too; a single sign-on
+session goes back to its [identity provider](#multi-factor-sign-in-at-the-identity-provider) for a new multi-factor
+sign-in (or to pgkiln's own second step, when the provider leaves it to pgkiln).
 A form posted after the time ran out is not processed: the user confirms, comes back to the page and submits again.
 
 #### REST API tokens
@@ -493,7 +530,8 @@ application users, so nothing to cover there.
 - **Stale sessions**: 60 minutes idle or 8 hours total (configurable).
 - **Stolen passwords**: [two-factor sign-in](#two-factor-sign-in) asks for a code from an authenticator app or a
   passkey, for every user or for some roles, and again before sensitive pages ([step-up](#asking-again-before-a-sensitive-page-step-up)); with an identity provider ([OpenID Connect](#single-sign-on-openid-connect),
-  [SAML](#single-sign-on-saml-20)) the provider asks for its own. Developers have
+  [SAML](#single-sign-on-saml-20)) the provider asks for its own, and pgkiln
+  [checks that it did](#multi-factor-sign-in-at-the-identity-provider). Developers have
   [two-factor sign-in](03-builder.md#two-factor-sign-in) for the builder too.
 
 All sign-ins, failures and lockouts appear in the **Activity** monitor.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pgkiln",
-  "version": "0.65.0",
+  "version": "0.66.0",
   "description": "Open source low-code, SQL-driven application builder for PostgreSQL, inspired by Oracle APEX",
   "keywords": [
     "postgresql",

package/public/builder.css

@@ -1576,3 +1576,9 @@ pre.wrap-pre { white-space: pre-wrap; overflow-wrap: anywhere; }
 .mfa-steps { padding-left: 1.25rem; }
 .mfa-codes { columns: 2; column-gap: 2rem; padding-left: 1.5rem; font-size: 1.05em; }
 @media (max-width: 480px) { .mfa-codes { columns: 1; } }
+
+/* Settings → Sign-in: a checkbox under a grid of fields gets room, and long help stays readable */
+.settings-panel[data-tab="signin"] .form-grid + .field { margin-top: 0.75rem; }
+.settings-panel[data-tab="signin"] .field > .help,
+.settings-panel[data-tab="signin"] p.small { max-width: 75ch; }
+.settings-panel[data-tab="signin"] h3:not(:first-child) { margin-top: 1.5rem; }

package/src/builder/i18n/de.ts

@@ -1295,6 +1295,9 @@ export const de: BuilderMessages = {
   'st.custom_post_help': 'Optionales PL/pgSQL nach einer erfolgreichen Prüfung, mit p_username (und meta.app_user()), z. B. um die letzte Anmeldung zu speichern. Eine Exception lehnt die Anmeldung ab. Anwendungsprozesse „after login“ laufen danach wie gewohnt.',
   'st.signin': 'Anmeldung',
   'st.methods': 'Anmeldemethoden',
+  'st.signin_page': 'Anmeldeseite',
+  'st.staying': 'Angemeldet bleiben',
+  'st.two_factor': 'Zwei-Faktor-Anmeldung',
   'st.local': 'Benutzername und Passwort',
   'st.ldap': 'Passwörter aus LDAP: {name}',
   'st.disabled': '(deaktiviert)',
@@ -1509,6 +1512,16 @@ export const de: BuilderMessages = {
   'idp.disabled_s': 'deaktiviert',
   'idp.auto_s': 'automatisch anlegen',
   'idp.links_s': 'verknüpft vorhandene Konten',
+  'idp.mfa_title': 'Mehrstufige Anmeldung',
+  'idp.mfa_required': 'Mehrstufige Anmeldung bei diesem Anbieter verlangen',
+  'idp.mfa_required_help': 'Anmeldungen (bei Anwendungen und im Builder) ablehnen, die der Anbieter nicht als mehrstufig kennzeichnet: bei OpenID Connect über den amr- oder acr-Claim des ID-Tokens, bei SAML über die AuthnContextClassRef.',
+  'idp.mfa_request': 'Beim Anbieter anfordern',
+  'idp.mfa_request_help': 'OpenID-Connect-acr_values oder SAML-AuthnContextClassRef-Werte, durch Leerzeichen getrennt. Leer: nichts anfordern.',
+  'idp.mfa_values': 'Werte, die mehrstufig bedeuten',
+  'idp.mfa_values_help': 'amr-, acr- oder AuthnContextClassRef-Werte, durch Leerzeichen getrennt; einer davon genügt. Entra ID und Okta setzen „mfa“ in amr.',
+  'idp.local_step': 'Nach diesem Anbieter den eigenen zweiten Schritt von pgkiln verlangen',
+  'idp.local_step_help': 'Für Anbieter, die keine mehrstufige Anmeldung erzwingen können: Die Zwei-Schritt-Regel der Anwendung gilt wie nach einem Passwort, und Entwickler mit einem zweiten Faktor geben ihn ebenfalls an. Eine erneute Bestätigung fragt dann nach dem Faktor in pgkiln, statt sich erneut beim Anbieter anzumelden.',
+  'idp.mfa_s': 'verlangt MFA',
   'idp.none': 'Noch keine Identitätsanbieter.',
   'idp.settings': 'Einstellungen',
   'idp.delete_confirm': '{name} löschen? Verknüpfte Identitäten werden entfernt; die Konten bleiben.',

package/src/builder/i18n/en.ts

@@ -1298,6 +1298,9 @@ export const en = {
   'st.custom_post_help': 'Optional PL/pgSQL run after a successful check, with p_username (and meta.app_user()), e.g. to record the last sign-in. Raising an exception refuses the sign-in. Application processes "after login" run afterwards as usual.',
   'st.signin': 'Sign-in',
   'st.methods': 'Sign-in methods',
+  'st.signin_page': 'Sign-in page',
+  'st.staying': 'Staying signed in',
+  'st.two_factor': 'Two-factor sign-in',
   'st.local': 'Username and password',
   'st.ldap': 'Passwords from LDAP: {name}',
   'st.disabled': '(disabled)',
@@ -1512,6 +1515,16 @@ export const en = {
   'idp.disabled_s': 'disabled',
   'idp.auto_s': 'auto-create',
   'idp.links_s': 'links existing accounts',
+  'idp.mfa_title': 'Multi-factor sign-in',
+  'idp.mfa_required': 'Require multi-factor sign-in at this provider',
+  'idp.mfa_required_help': "Refuse sign-ins (to applications and to the builder) that the provider does not mark as multi-factor: OpenID Connect through the ID token's amr or acr claim, SAML through the AuthnContextClassRef.",
+  'idp.mfa_request': 'Ask the provider for',
+  'idp.mfa_request_help': 'OpenID Connect acr_values or SAML AuthnContextClassRef values, separated by spaces. Empty: ask for nothing.',
+  'idp.mfa_values': 'Values that mean multi-factor',
+  'idp.mfa_values_help': 'amr, acr or AuthnContextClassRef values, separated by spaces; any one of them is enough. Entra ID and Okta put "mfa" in amr.',
+  'idp.local_step': "Ask pgkiln's own second step after this provider",
+  'idp.local_step_help': "For providers that cannot require multi-factor sign-in: the application's two-step rule applies as after a password, and developers with a second factor give it too. Step-up then asks for pgkiln's factor instead of signing in at the provider again.",
+  'idp.mfa_s': 'requires MFA',
   'idp.none': 'No identity providers yet.',
   'idp.settings': 'Settings',
   'idp.delete_confirm': 'Delete {name}? Linked identities are removed; accounts stay.',

package/src/builder/i18n/es.ts

@@ -1295,6 +1295,9 @@ export const es: BuilderMessages = {
   'st.custom_post_help': 'PL/pgSQL opcional que se ejecuta tras una comprobación correcta, con p_username (y meta.app_user()), p. ej. para registrar el último inicio de sesión. Lanzar una excepción rechaza el inicio de sesión. Los procesos de aplicación «after login» se ejecutan después como siempre.',
   'st.signin': 'Inicio de sesión',
   'st.methods': 'Métodos de inicio de sesión',
+  'st.signin_page': 'Página de inicio de sesión',
+  'st.staying': 'Mantener la sesión',
+  'st.two_factor': 'Inicio de sesión en dos pasos',
   'st.local': 'Nombre de usuario y contraseña',
   'st.ldap': 'Contraseñas de LDAP: {name}',
   'st.disabled': '(desactivado)',
@@ -1509,6 +1512,16 @@ export const es: BuilderMessages = {
   'idp.disabled_s': 'desactivado',
   'idp.auto_s': 'creación automática',
   'idp.links_s': 'vincula cuentas existentes',
+  'idp.mfa_title': 'Inicio de sesión multifactor',
+  'idp.mfa_required': 'Exigir inicio de sesión multifactor en este proveedor',
+  'idp.mfa_required_help': 'Rechaza los inicios de sesión (en aplicaciones y en el builder) que el proveedor no marca como multifactor: en OpenID Connect por el claim amr o acr del token de ID, en SAML por el AuthnContextClassRef.',
+  'idp.mfa_request': 'Solicitar al proveedor',
+  'idp.mfa_request_help': 'Valores acr_values de OpenID Connect o AuthnContextClassRef de SAML, separados por espacios. Vacío: no solicitar nada.',
+  'idp.mfa_values': 'Valores que significan multifactor',
+  'idp.mfa_values_help': 'Valores amr, acr o AuthnContextClassRef, separados por espacios; basta con uno. Entra ID y Okta ponen «mfa» en amr.',
+  'idp.local_step': 'Pedir el segundo paso propio de pgkiln después de este proveedor',
+  'idp.local_step_help': 'Para proveedores que no pueden exigir multifactor: la regla de dos pasos de la aplicación se aplica como después de una contraseña, y los desarrolladores con un segundo factor también lo indican. La nueva confirmación pide entonces el factor de pgkiln en lugar de volver a iniciar sesión en el proveedor.',
+  'idp.mfa_s': 'exige MFA',
   'idp.none': 'Todavía no hay proveedores de identidad.',
   'idp.settings': 'Ajustes',
   'idp.delete_confirm': '¿Eliminar {name}? Se quitan las identidades vinculadas; las cuentas se mantienen.',

package/src/builder/i18n/fr.ts

@@ -1295,6 +1295,9 @@ export const fr: BuilderMessages = {
   'st.custom_post_help': 'PL/pgSQL facultatif exécuté après une vérification réussie, avec p_username (et meta.app_user()), p. ex. pour enregistrer la dernière connexion. Lever une exception refuse la connexion. Les processus d’application « after login » s’exécutent ensuite comme d’habitude.',
   'st.signin': 'Connexion',
   'st.methods': 'Méthodes de connexion',
+  'st.signin_page': 'Page de connexion',
+  'st.staying': 'Rester connecté',
+  'st.two_factor': 'Connexion en deux étapes',
   'st.local': 'Nom d’utilisateur et mot de passe',
   'st.ldap': 'Mots de passe LDAP : {name}',
   'st.disabled': '(désactivé)',
@@ -1509,6 +1512,16 @@ export const fr: BuilderMessages = {
   'idp.disabled_s': 'désactivé',
   'idp.auto_s': 'création automatique',
   'idp.links_s': 'lie les comptes existants',
+  'idp.mfa_title': 'Connexion multifacteur',
+  'idp.mfa_required': 'Exiger une connexion multifacteur chez ce fournisseur',
+  'idp.mfa_required_help': 'Refuser les connexions (aux applications et au builder) que le fournisseur ne marque pas comme multifacteur : en OpenID Connect par le claim amr ou acr du jeton d’identité, en SAML par l’AuthnContextClassRef.',
+  'idp.mfa_request': 'Demander au fournisseur',
+  'idp.mfa_request_help': 'Valeurs acr_values (OpenID Connect) ou AuthnContextClassRef (SAML), séparées par des espaces. Vide : ne rien demander.',
+  'idp.mfa_values': 'Valeurs qui signifient multifacteur',
+  'idp.mfa_values_help': 'Valeurs amr, acr ou AuthnContextClassRef, séparées par des espaces ; une seule suffit. Entra ID et Okta mettent « mfa » dans amr.',
+  'idp.local_step': 'Demander la deuxième étape de pgkiln après ce fournisseur',
+  'idp.local_step_help': 'Pour les fournisseurs qui ne peuvent pas exiger le multifacteur : la règle de connexion en deux étapes de l’application s’applique comme après un mot de passe, et les développeurs ayant un second facteur le donnent aussi. Une nouvelle confirmation demande alors le facteur de pgkiln au lieu de se reconnecter chez le fournisseur.',
+  'idp.mfa_s': 'exige la MFA',
   'idp.none': 'Pas encore de fournisseurs d’identité.',
   'idp.settings': 'Paramètres',
   'idp.delete_confirm': 'Supprimer {name} ? Les identités liées sont retirées ; les comptes restent.',

package/src/builder/i18n/nl.ts

@@ -1295,6 +1295,9 @@ export const nl: BuilderMessages = {
   'st.custom_post_help': 'Optionele PL/pgSQL die draait na een geslaagde controle, met p_username (en meta.app_user()), bijv. om de laatste aanmelding vast te leggen. Een exception weigert de aanmelding. Applicatieprocessen “after login” draaien daarna zoals gewoonlijk.',
   'st.signin': 'Aanmelden',
   'st.methods': 'Aanmeldmethoden',
+  'st.signin_page': 'Aanmeldpagina',
+  'st.staying': 'Aangemeld blijven',
+  'st.two_factor': 'Aanmelden in twee stappen',
   'st.local': 'Gebruikersnaam en wachtwoord',
   'st.ldap': 'Wachtwoorden uit LDAP: {name}',
   'st.disabled': '(uitgeschakeld)',
@@ -1509,6 +1512,16 @@ export const nl: BuilderMessages = {
   'idp.disabled_s': 'uitgeschakeld',
   'idp.auto_s': 'automatisch aanmaken',
   'idp.links_s': 'koppelt bestaande accounts',
+  'idp.mfa_title': 'Meervoudige aanmelding',
+  'idp.mfa_required': 'Meervoudige aanmelding bij deze provider vereisen',
+  'idp.mfa_required_help': 'Aanmeldingen (bij applicaties en in de builder) weigeren die de provider niet als meervoudig aanmerkt: bij OpenID Connect via de amr- of acr-claim van het ID-token, bij SAML via de AuthnContextClassRef.',
+  'idp.mfa_request': 'Vragen aan de provider',
+  'idp.mfa_request_help': 'OpenID Connect-acr_values of SAML-AuthnContextClassRef-waarden, gescheiden door spaties. Leeg: niets vragen.',
+  'idp.mfa_values': 'Waarden die meervoudig betekenen',
+  'idp.mfa_values_help': 'amr-, acr- of AuthnContextClassRef-waarden, gescheiden door spaties; één ervan is genoeg. Entra ID en Okta zetten "mfa" in amr.',
+  'idp.local_step': 'Na deze provider ook de eigen tweede stap van pgkiln vragen',
+  'idp.local_step_help': 'Voor providers die geen meervoudige aanmelding kunnen afdwingen: de tweestapsregel van de applicatie geldt zoals na een wachtwoord, en ontwikkelaars met een tweede factor geven die ook. Opnieuw bevestigen vraagt dan de factor in pgkiln in plaats van opnieuw aanmelden bij de provider.',
+  'idp.mfa_s': 'vereist MFA',
   'idp.none': 'Nog geen identiteitsproviders.',
   'idp.settings': 'Instellingen',
   'idp.delete_confirm': '{name} verwijderen? Gekoppelde identiteiten worden verwijderd; de accounts blijven.',

package/src/builder/i18n/pt.ts

@@ -1295,6 +1295,9 @@ export const pt: BuilderMessages = {
   'st.custom_post_help': 'PL/pgSQL opcional executado após uma verificação bem-sucedida, com p_username (e meta.app_user()), por exemplo para registrar o último login. Lançar uma exceção recusa o login. Processos de aplicação “after login” são executados depois, como de costume.',
   'st.signin': 'Login',
   'st.methods': 'Métodos de login',
+  'st.signin_page': 'Página de acesso',
+  'st.staying': 'Manter o acesso',
+  'st.two_factor': 'Acesso em duas etapas',
   'st.local': 'Nome de usuário e senha',
   'st.ldap': 'Senhas do LDAP: {name}',
   'st.disabled': '(desativado)',
@@ -1509,6 +1512,16 @@ export const pt: BuilderMessages = {
   'idp.disabled_s': 'desativado',
   'idp.auto_s': 'criação automática',
   'idp.links_s': 'vincula contas existentes',
+  'idp.mfa_title': 'Acesso multifator',
+  'idp.mfa_required': 'Exigir acesso multifator neste provedor',
+  'idp.mfa_required_help': 'Recusar acessos (às aplicações e ao builder) que o provedor não marca como multifator: no OpenID Connect pelo claim amr ou acr do token de ID, no SAML pelo AuthnContextClassRef.',
+  'idp.mfa_request': 'Pedir ao provedor',
+  'idp.mfa_request_help': 'Valores acr_values do OpenID Connect ou AuthnContextClassRef do SAML, separados por espaços. Vazio: não pedir nada.',
+  'idp.mfa_values': 'Valores que significam multifator',
+  'idp.mfa_values_help': 'Valores amr, acr ou AuthnContextClassRef, separados por espaços; basta um deles. Entra ID e Okta colocam "mfa" em amr.',
+  'idp.local_step': 'Pedir a segunda etapa do próprio pgkiln após este provedor',
+  'idp.local_step_help': 'Para provedores que não conseguem exigir multifator: a regra de duas etapas da aplicação vale como após uma senha, e desenvolvedores com um segundo fator também o informam. A nova confirmação pede então o fator do pgkiln em vez de entrar de novo no provedor.',
+  'idp.mfa_s': 'exige MFA',
   'idp.none': 'Ainda não há provedores de identidade.',
   'idp.settings': 'Configurações',
   'idp.delete_confirm': 'Excluir {name}? As identidades vinculadas são removidas; as contas ficam.',

package/src/builder/login-page.ts

@@ -23,7 +23,7 @@ interface AppRow {
   mfa_email: boolean;
 }
 
-/** The fields in the settings form. */
+/** The fields in the settings form: the sign-in page, and two-factor sign-in (each placed by the settings page). */
 export async function loginSettingsFields(a: AppRow) {
   const pages = (await owner.query<{ page_no: number; name: string; requires_auth: boolean }>(
     'select page_no, name, requires_auth from meta.page where app_id = $1 order by page_no', [a.id],
@@ -33,35 +33,33 @@ export async function loginSettingsFields(a: AppRow) {
        from meta.app_mail_service ams join meta.mail_service s on s.id = ams.service_id where ams.app_id = $1`, [a.id],
   );
   const mailOk = !!(mail?.enabled && mail.from_address?.trim());
+  const noMail = html`<strong>Not offered yet:</strong> the application needs an enabled mail service with a From address (Workspace utilities → Mail services).`;
   const opt = (v: string, label: string, cur: string) => html`<option value="${v}"${v === cur ? raw(' selected') : ''}>${label}</option>`;
   const current = a.login_page ? String(a.login_page) : '';
-  return html`<div class="form-grid">
+  const page = html`<div class="form-grid">
       <div class="field"><label class="label" for="f_login_page">Login page</label>
         <select id="f_login_page" name="login_page">${opt('', '- the built-in sign-in page -', current)}${pages.map((p) =>
           opt(String(p.page_no), `${p.page_no} ${p.name}${p.requires_auth ? ' (requires sign-in: not usable)' : ''}`, current))}</select>
-        <small class="help">A page of the application with a <em>Login</em> region replaces the built-in sign-in page (APEX: the login page). It must not require authentication; with page template <em>Minimal</em> it has no header and navigation.
+        <small class="help">A public page with a <em>Login</em> region (APEX: the login page); page template <em>Minimal</em> hides the header and navigation.
           <button class="link-button" formaction="${BASE}/apps/${a.id}/login-page">Create a login page</button></small></div>
-      <div class="field"><span class="label" aria-hidden="true"></span><label class="check"><input type="checkbox" name="password_reset" value="true"${a.password_reset ? raw(' checked') : ''}> Offer "Forgot password?"</label>
-        <small class="help">Users with a password and an e-mail address in the user directory get a link to choose a new password (single-use, valid for 30 minutes).
-          ${mailOk
-            ? html`Sent through mail service ${mail!.service} as ${mail!.from_address}.`
-            : html`<strong>Not offered yet:</strong> the application needs an enabled mail service with a From address (Workspace utilities → Mail services).`}
-          Only for the user directory's own passwords: not for LDAP, single sign-on, database accounts or custom authentication.</small></div>
     </div>
-    <h3 id="two-factor">Two-factor sign-in</h3>
-    <div class="form-grid">
+    <div class="field"><label class="check"><input type="checkbox" name="password_reset" value="true"${a.password_reset ? raw(' checked') : ''}> Offer "Forgot password?"</label>
+      <small class="help">Users with a password and an e-mail address in the user directory get a single-use link, valid for 30 minutes, to choose a new password. Only for the user directory's own passwords.
+        ${mailOk ? html`Sent through mail service ${mail!.service} as ${mail!.from_address}.` : noMail}</small></div>`;
+  const twoFactor = html`<div class="form-grid">
       <div class="field"><label class="label" for="f_mfa">Second step</label>
         <select id="f_mfa" name="mfa" aria-describedby="f_mfa_help">${(APP_MFA as string[]).map((m) => opt(m, MFA_LABELS[m as AppMfa], a.mfa))}</select>
-        <small class="help" id="f_mfa_help">After the password (or an LDAP directory), users give a code from an authenticator app or a recovery code. They add the app on <em>My account</em>, or while signing in when it is required. An identity provider asks for its own second factor. Accounts share their apps across applications.
+        <small class="help" id="f_mfa_help">After the password or an LDAP directory: a code from an authenticator app, a passkey or a recovery code, added on <em>My account</em> or while signing in.
           ${secretKeyConfigured() ? '' : html`<strong>Not available yet:</strong> the server needs <code>PGKILN_SECRET_KEY</code> to keep the apps' secrets.`}</small></div>
       <div class="field"><label class="label" for="f_mfa_roles">Required for roles</label>
         <input id="f_mfa_roles" name="mfa_roles" value="${(a.mfa_roles ?? []).join(', ')}" placeholder="admin, manager" aria-describedby="f_mfa_roles_help">
         <small class="help" id="f_mfa_roles_help">With <em>Required for some roles</em>: users with one of these roles must use it, others may.</small></div>
-      <div class="field"><span class="label" aria-hidden="true"></span><label class="check"><input type="checkbox" name="mfa_email" value="true"${a.mfa_email ? raw(' checked') : ''}> Offer a code by e-mail</label>
-        <small class="help">At the second step, users who have an authenticator app or a passkey may ask for a one-time code by e-mail instead (valid ${EMAIL_CODE_MINUTES} minutes, at most ${EMAIL_CODES_PER_HOUR} an hour). It is never someone's only factor: a user who must add one still adds an app or a passkey.
-          ${mailOk ? '' : html`<strong>Not offered yet:</strong> the application needs an enabled mail service with a From address.`}</small></div>
     </div>
-    <p class="muted small">Users also add <strong>passkeys</strong> (fingerprint, face, PIN or a security key) on <em>My account</em> or while signing in; they need the application at a host name, not an IP address. To ask for the second step again before a page opens (step-up), give its authorization scheme <em>Second step within (minutes)</em> in Shared Components.</p>`;
+    <div class="field"><label class="check"><input type="checkbox" name="mfa_email" value="true"${a.mfa_email ? raw(' checked') : ''}> Offer a code by e-mail</label>
+      <small class="help">Users who already have an app or a passkey may get a one-time code by e-mail instead (valid ${EMAIL_CODE_MINUTES} minutes, at most ${EMAIL_CODES_PER_HOUR} an hour); never as their only factor.
+        ${mailOk ? '' : noMail}</small></div>
+    <p class="muted small">Passkeys need the application at a host name, not an IP address. Identity providers ask for their own second factor (see the provider's <em>Multi-factor sign-in</em>). To ask again before a page opens (step-up), give its authorization scheme <em>Second step within (minutes)</em> in Shared Components.</p>`;
+  return { page, twoFactor };
 }
 
 const MFA_LABELS: Record<AppMfa, string> = { off: 'Off', optional: 'Optional (users may add an app)', required: 'Required', roles: 'Required for some roles' };

package/src/builder/routes.ts

@@ -264,7 +264,16 @@ export async function builderRoutes(app: FastifyInstance) {
     const username = await resolveDeveloper(src, { ...result.identity, username: result.username, groups: result.groups });
     const dev = await owner.one<{ username: string; language: string | null }>('select username, language from meta.developer where username = $1', [username]);
     if (!dev) throw new SsoError('The developer was removed.');
-    return finishSignIn(req, reply, null, dev, { ws: null, workspace: '', next: safeNext(result.next), remember: false, weak: false, picked: null, detail: `builder sso:${p.name}`, sso: p.name });
+    // (sprint 132, SEC-4) the provider leaves the second step to pgkiln: as after a password (the trusted-browser
+    // cookie belongs to /builder and doesn't reach this callback, so the step is always asked); a developer without a
+    // factor signs in without __SSO, so a 2FA rule makes them add one (ui.ts)
+    if (p.local_second_step && (await hasFactor(dev.username))) {
+      const ns = await createSession(reply, null, BASE);
+      ns.state.__MFA = JSON.stringify({ u: dev.username, ws: null, w: '', next: safeNext(result.next), remember: false, weak: false, at: Date.now() });
+      await saveState(ns);
+      return reply.redirect(`${BASE}/login/2fa`, 303);
+    }
+    return finishSignIn(req, reply, null, dev, { ws: null, workspace: '', next: safeNext(result.next), remember: false, weak: false, picked: null, detail: `builder sso:${p.name}${result.mfa ? ' (mfa)' : ''}`, sso: p.local_second_step ? undefined : p.name });
   });
 
   // (sprint 128, SEC-2) signing in with a passkey alone: no user name, no password. The browser offers the
@@ -762,6 +771,7 @@ export async function builderRoutes(app: FastifyInstance) {
     if (!a) return reply.code(404).send('Not found');
     const providers = (await owner.query('select name, display_name, enabled from meta.auth_provider order by display_name')).rows;
     const directories = (await owner.query('select name, display_name, enabled from meta.ldap_directory order by display_name')).rows;
+    const signinFields = await loginSettingsFields(a);
     const lists = (await owner.query('select name from meta.list where app_id = $1 order by name', [a.id])).rows.map((r) => r.name as string);
     const listChoices = (v: string | null, none: string): [string, string][] => [['', none], ...lists.map((n): [string, string] => [n, n]), ...(v && !lists.includes(v) ? [[v, tx('st.missing', { name: v })] as [string, string]] : [])];
     // (sprint 74) tabs like APEX's Edit Application Definition and Security Attributes: every tab of the
@@ -822,15 +832,21 @@ export async function builderRoutes(app: FastifyInstance) {
             <h3>${tx('st.methods')}</h3>
             <div class="field"><label class="check"><input type="checkbox" name="local_login" value="true"${a.local_login ? raw(' checked') : ''}> ${tx('st.local')}</label></div>
             ${directories.length
-              ? directories.map((d) => html`<div class="field"><label class="check"><input type="checkbox" name="ldap_directories" value="${d.name}"${a.ldap_directories.includes(d.name) ? raw(' checked') : ''}> ${tx('st.ldap', { name: d.display_name })}${d.enabled ? '' : ` ${tx('st.disabled')}`}</label></div>`)
-              : html`<p class="muted">${tx.rich('st.no_ldap', { add: html`<a href="${BASE}/users/directories">${tx('st.add_one')}</a>` })}</p>`}
-            <small class="help">${tx('st.ldap_help')}</small>
-            <div class="form-grid">${input('session_group', tx('st.session_group'), a.session_group ?? '', { placeholder: tx('st.session_group_ph'), help: tx('st.session_group_help') })}</div>
-            ${await loginSettingsFields(a)}
-            <div class="form-grid">${input('remember_me_days', tx('st.remember'), a.remember_me_days ?? '', { type: 'number', placeholder: tx('st.remember_ph'), help: tx('st.remember_help') })}</div>
+              ? html`${directories.map((d) => html`<div class="field"><label class="check"><input type="checkbox" name="ldap_directories" value="${d.name}"${a.ldap_directories.includes(d.name) ? raw(' checked') : ''}> ${tx('st.ldap', { name: d.display_name })}${d.enabled ? '' : ` ${tx('st.disabled')}`}</label></div>`)}
+                <small class="help">${tx('st.ldap_help')}</small>`
+              : html`<p class="muted small">${tx.rich('st.no_ldap', { add: html`<a href="${BASE}/users/directories">${tx('st.add_one')}</a>` })}</p>`}
             ${providers.length
               ? providers.map((pr) => html`<div class="field"><label class="check"><input type="checkbox" name="sso_providers" value="${pr.name}"${a.sso_providers.includes(pr.name) ? raw(' checked') : ''}> ${tx('st.sso', { name: pr.display_name })}${pr.enabled ? '' : ` ${tx('st.disabled')}`}</label></div>`)
-              : html`<p class="muted">${tx.rich('st.no_sso', { add: html`<a href="${BASE}/users/providers">${tx('st.add_one')}</a>` })}</p>`}
+              : html`<p class="muted small">${tx.rich('st.no_sso', { add: html`<a href="${BASE}/users/providers">${tx('st.add_one')}</a>` })}</p>`}
+            <h3>${tx('st.signin_page')}</h3>
+            ${signinFields.page}
+            <h3>${tx('st.staying')}</h3>
+            <div class="form-grid">
+              ${input('remember_me_days', tx('st.remember'), a.remember_me_days ?? '', { type: 'number', placeholder: tx('st.remember_ph'), help: tx('st.remember_help') })}
+              ${input('session_group', tx('st.session_group'), a.session_group ?? '', { placeholder: tx('st.session_group_ph'), help: tx('st.session_group_help') })}
+            </div>
+            <h3 id="two-factor">${tx('st.two_factor')}</h3>
+            ${signinFields.twoFactor}
             `)}${end}
             ${panel('ui')}${region(tx('st.tab.ui'), html`
             <h3>${tx('st.theme')}</h3>

package/src/builder/users.ts

@@ -398,6 +398,9 @@ export async function usersRoutes(app: FastifyInstance) {
   });
 
   // ---------------------------------------------------------------- identity providers (OpenID Connect)
+  /** (134) the values a new provider counts as a second factor: amr "mfa" (Entra ID, Okta), Entra ID's and SAML's own */
+  const DEFAULT_MFA_VALUES = ['mfa', 'http://schemas.microsoft.com/claims/multipleauthn',
+    'urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract', 'urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorUnregistered'];
   const providerForm = (pr: any, action: string, csrfField: ReturnType<typeof csrf>, isNew: boolean, tx: BuilderTranslate) => html`
     <form method="post" action="${action}">${csrfField}
       <div class="form-grid">
@@ -419,6 +422,16 @@ export async function usersRoutes(app: FastifyInstance) {
         <small class="help">${tx('idp.auto_create_help')}</small></div>
       <div class="field"><label class="check"><input type="checkbox" name="link_existing" value="true"${pr.link_existing ? raw(' checked') : ''}> ${tx('idp.link')}</label>
         <small class="help">${tx('idp.link_help')}</small></div>
+      <fieldset class="prop-group u-mt075"><legend>${tx('idp.mfa_title')}</legend>
+        <div class="field"><label class="check"><input type="checkbox" name="mfa_required" value="true"${pr.mfa_required ? raw(' checked') : ''}> ${tx('idp.mfa_required')}</label>
+          <small class="help">${tx('idp.mfa_required_help')}</small></div>
+        <div class="form-grid">
+          ${input('mfa_request', tx('idp.mfa_request'), pr.mfa_request ?? '', { help: tx('idp.mfa_request_help') })}
+          ${input('mfa_values', tx('idp.mfa_values'), (pr.mfa_values ?? DEFAULT_MFA_VALUES).join(' '), { help: tx('idp.mfa_values_help') })}
+        </div>
+        <div class="field"><label class="check"><input type="checkbox" name="local_second_step" value="true"${pr.local_second_step ? raw(' checked') : ''}> ${tx('idp.local_step')}</label>
+          <small class="help">${tx('idp.local_step_help')}</small></div>
+      </fieldset>
       <div class="field"><label class="check"><input type="checkbox" name="enabled" value="true"${pr.enabled !== false ? raw(' checked') : ''}> ${tx('idp.enabled')}</label></div>
       ${!isNew && pr.has_secret ? html`<div class="field"><label class="check"><input type="checkbox" name="remove_secret" value="true"> ${tx('idp.remove_secret')}</label></div>` : ''}
       <div class="buttons"><button class="btn btn-hot">${isNew ? tx('idp.add') : tx('us.save')}</button></div>
@@ -439,13 +452,17 @@ export async function usersRoutes(app: FastifyInstance) {
     b.auto_create === 'true', b.enabled === 'true',
     protocol === 'saml' ? b.idp_sso_url?.trim() || null : null, protocol === 'saml' ? pem(b.idp_cert) : null,
     b.link_existing === 'true',
+    // (sprint 132, SEC-4) multi-factor sign-in at the provider
+    b.mfa_required === 'true', b.mfa_request?.trim().replace(/\s+/g, ' ').slice(0, 500) || null,
+    words(b.mfa_values).length ? words(b.mfa_values) : DEFAULT_MFA_VALUES, b.local_second_step === 'true',
   ];
+  const words = (v: string | undefined) => [...new Set((v ?? '').split(/\s+/).filter(Boolean))].slice(0, 20);
 
   app.get(`${BASE}/users/providers`, async (req: Req, reply) => {
     const s = await administrator(req, reply, 'Identity providers');
     if (!s) return;
     const tx = tr(s);
-    const rows = (await owner.query(`select id, name, display_name, issuer, enabled, auto_create, link_existing,
+    const rows = (await owner.query(`select id, name, display_name, issuer, enabled, auto_create, link_existing, mfa_required,
         (select count(*) from meta.account_identity i where i.provider_id = p.id)::int as linked,
         (select string_agg(a.alias, ', ' order by a.alias) from meta.app a where p.name = any(a.sso_providers)) as apps
       from meta.auth_provider p order by display_name`)).rows;
@@ -460,7 +477,7 @@ export async function usersRoutes(app: FastifyInstance) {
             <td data-label="${tx('idp.issuer_col')}">${r.issuer}</td>
             <td data-label="${tx('idp.used_by')}">${r.apps ?? html`<span class="muted">${tx('idp.no_apps')}</span>`}</td>
             <td data-label="${tx('idp.linked')}">${r.linked}</td>
-            <td data-label="${tx('us.status')}">${r.enabled ? tx('idp.enabled_s') : html`<b>${tx('idp.disabled_s')}</b>`}${r.auto_create ? ` · ${tx('idp.auto_s')}` : ''}${r.link_existing ? ` · ${tx('idp.links_s')}` : ''}</td>
+            <td data-label="${tx('us.status')}">${r.enabled ? tx('idp.enabled_s') : html`<b>${tx('idp.disabled_s')}</b>`}${r.auto_create ? ` · ${tx('idp.auto_s')}` : ''}${r.link_existing ? ` · ${tx('idp.links_s')}` : ''}${r.mfa_required ? ` · ${tx('idp.mfa_s')}` : ''}</td>
           </tr>`) : html`<tr><td colspan="5" class="empty">${tx('idp.none')}</td></tr>`}</tbody></table></div>`)}
         ${region(tx('idp.add'), providerForm({}, `${BASE}/users/providers`, csrf(s), true, tx))}
       </div>`;
@@ -473,8 +490,9 @@ export async function usersRoutes(app: FastifyInstance) {
     const b = req.body ?? {};
     try {
       const r = await owner.one(
-        `insert into meta.auth_provider (name, display_name, issuer, client_id, scopes, username_claim, groups_claim, auto_create, enabled, idp_sso_url, idp_cert, link_existing, protocol, client_secret)
-         values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14) returning id`,
+        `insert into meta.auth_provider (name, display_name, issuer, client_id, scopes, username_claim, groups_claim, auto_create, enabled, idp_sso_url, idp_cert, link_existing,
+                                         mfa_required, mfa_request, mfa_values, local_second_step, protocol, client_secret)
+         values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18) returning id`,
         [b.name?.trim().toLowerCase(), ...providerValues(b, protocolOf(b.protocol), b.name?.trim().toLowerCase() ?? ''), protocolOf(b.protocol), b.client_secret || null],
       );
       flash(s, tr(s)('idp.added'));
@@ -523,7 +541,8 @@ export async function usersRoutes(app: FastifyInstance) {
       await owner.query(
         `update meta.auth_provider set display_name = $2, issuer = $3, client_id = $4, scopes = $5, username_claim = $6,
                 groups_claim = $7, auto_create = $8, enabled = $9, idp_sso_url = $10, idp_cert = $11, link_existing = $12,
-                client_secret = case when $14 then null when $13::text is null then client_secret else $13 end
+                mfa_required = $13, mfa_request = $14, mfa_values = $15, local_second_step = $16,
+                client_secret = case when $18 then null when $17::text is null then client_secret else $17 end
           where id = $1`,
         [req.params.id, ...providerValues(b, current.protocol, current.name), b.client_secret || null, b.remove_secret === 'true'],
       );

package/src/runtime/routes.ts

@@ -49,7 +49,7 @@ import { chrome, dialogClosePage, languagePicker, renderPage } from './render.ts
 import { LOGIN_ERROR, LOGIN_USER, safeNext, signInForm } from './signin.ts';
 import { passwordResetRoutes } from './password-reset.ts';
 import { passwordSignIn, twoStepRoutes } from './two-step.ts';
-import { carriesSecondStep } from '../account-mfa.ts';
+import { carriesSecondStep, markSecondStep } from '../account-mfa.ts';
 import { devbarOf, devbarRoutes, sessionDebugLevel } from './devbar.ts';
 import { availabilityRefusal } from './availability.ts';
 import { feedbackRoutes } from './feedback.ts';
@@ -141,6 +141,8 @@ export async function signIn(req: FastifyRequest, reply: FastifyReply, a: App, o
   // (067) session sharing: the session belongs to the group's shared sign-in (a new one after a real sign-in)
   const shared = opts.shared ?? (await issueShared(req, reply, a, username, { groups: opts.groups, method: opts.method }));
   if (shared) s.state.__SHARED = shared;
+  // (sprint 132) how the session signed in: a step-up after "sso:<provider>" goes back to that provider
+  if (opts.method) s.state.__SIGNIN = opts.method;
   await saveState(s);
 
   // the application processes "after login", then (102) the application computations "after authentication"
@@ -162,6 +164,9 @@ export async function signIn(req: FastifyRequest, reply: FastifyReply, a: App, o
   return s;
 }
 
+/** (sprint 132) Set by the runtime routes: a step-up through an identity provider (two-step.ts). */
+export let ssoStepUp: (reply: FastifyReply, a: App, s: Session, p: Provider, next: string) => Promise<unknown>;
+
 export async function completeLogin(req: FastifyRequest, reply: FastifyReply, a: App, oldSession: Session, username: string, opts: SignInOptions & { next?: string } = {}) {
   await signIn(req, reply, a, oldSession, username, opts);
   return reply.redirect(safeNext(a, opts.next), 303);
@@ -1345,6 +1350,13 @@ export async function runtimeRoutes(app: FastifyInstance) {
     }
   });
 
+  /** (sprint 132) A step-up through the identity provider the session signed in with (two-step.ts). */
+  ssoStepUp = async (reply: FastifyReply, a: App, s: Session, p: Provider, next: string) => {
+    const { url, browserKey } = p.protocol === 'saml' ? await startSamlSignIn(p, a.id, next, undefined, s.id) : await startSignIn(p, a.id, next, undefined, s.id);
+    reply.setCookie(SSO_COOKIE, browserKey, { path: '/sso', httpOnly: true, sameSite: 'lax', secure: process.env.COOKIE_SECURE === 'true', maxAge: 600 });
+    return reply.redirect(url, 303);
+  };
+
   app.get<{ Params: { provider: string } }>('/sso/callback/:provider', async (req, reply) => {
     const ip = clientIp(req);
     const p = await loadProvider(req.params.provider);
@@ -1375,9 +1387,24 @@ export async function runtimeRoutes(app: FastifyInstance) {
         return simplePage(reply, 403, english('login.sso_failed'), e.message, result.link ? '/builder/security' : '/builder/login');
       });
     }
+    if (result.stepup) return withAppDb(result.appId, () => finishSsoStepUp(req, reply, p, result, ip));
     return withAppDb(result.appId, () => finishSsoForApp(req, reply, p, result, ip));
   };
-  const finishSsoForApp = async (req: FastifyRequest, reply: FastifyReply, p: { name: string }, result: SsoResult, ip: string) => {
+  /** (sprint 132) A step-up confirmed by the provider: the session that asked for it gets its second step. */
+  const finishSsoStepUp = async (req: FastifyRequest, reply: FastifyReply, p: Provider, result: SsoResult, ip: string) => {
+    const s = await runtime.one<{ id: string; app_id: number; username: string | null; state: Record<string, unknown> }>(
+      'select id, app_id, username, state from meta.session where id = $1', [result.stepup]);
+    const a = s ? await loadApp((await runtime.one<{ alias: string }>('select alias from meta.app where id = $1', [s.app_id]))?.alias ?? '') : undefined;
+    if (!s || !a || s.app_id !== result.appId || s.username?.toLowerCase() !== result.username.toLowerCase()) {
+      logActivity({ appId: result.appId, username: result.username, event: 'login_failed', ip, detail: `sso:${p.name}: step-up for another session or user` });
+      return simplePage(reply, 403, english('login.sso_failed'), english('login.sso_incomplete'));
+    }
+    markSecondStep(s.state);
+    await runtime.query('update meta.session set state = $2 where id = $1', [s.id, s.state]);
+    await logActivity({ appId: a.id, username: s.username, event: '2fa_stepup', ip, detail: `sso:${p.name}` });
+    return reply.redirect(safeNext(a, result.next ?? undefined), 303);
+  };
+  const finishSsoForApp = async (req: FastifyRequest, reply: FastifyReply, p: Provider, result: SsoResult, ip: string) => {
     const alias = (await runtime.one<{ alias: string }>('select alias from meta.app where id = $1', [result.appId]))?.alias;
     const loaded = alias ? await appWithLocale(req, alias) : undefined;
     if (!loaded || loaded.app.authentication !== 'app_users' || !loaded.app.sso_providers.includes(p.name)) return simplePage(reply, 403, english('login.sso_failed'), english('login.method_unavailable'));
@@ -1388,7 +1415,16 @@ export async function runtimeRoutes(app: FastifyInstance) {
       return simplePage(reply, 403, locale.t('login.no_access_title'), locale.t('login.no_access', { user: result.username, app: a.name }), `/a/${a.alias}/login`, locale);
     }
     const session = await getSession(req, reply, a.id, `/a/${a.alias}`);
-    return completeLogin(req, reply, a, session, result.username, { extraRoles: access.roles, next: result.next ?? undefined, method: `sso:${p.name}`, detail: `sso:${p.name}` });
+    const opts = { extraRoles: access.roles, next: result.next ?? undefined, method: `sso:${p.name}`, detail: `sso:${p.name}${result.mfa ? ' (mfa)' : ''}` };
+    // (sprint 132) pgkiln's own second step after the provider, as after a password
+    if (p.local_second_step) return passwordSignIn(req, reply, a, session, result.username, opts);
+    const s = await signIn(req, reply, a, session, result.username, opts);
+    // the provider's second factor counts for step-up (authorization schemes with mfa_minutes)
+    if (result.mfa) {
+      markSecondStep(s.state);
+      await saveState(s);
+    }
+    return reply.redirect(safeNext(a, opts.next), 303);
   };
 
   // SAML: the IdP posts the response cross-site, where SameSite=Lax cookies aren't sent; post it on

package/src/runtime/two-step.ts

@@ -19,7 +19,8 @@ import { ALGORITHMS, giveChallenge, relyingParty, takeChallenge, verifyAssertion
 import type { PageContext } from './context.ts';
 import type { Locale } from './locale.ts';
 import { pwaHead } from './pwa.ts';
-import { appWithLocale, completeLogin, loadContext, rootAttrs, safeNext, signIn, type Req } from './routes.ts';
+import { loadProvider, type Provider } from '../sso.ts';
+import { appWithLocale, completeLogin, loadContext, rootAttrs, safeNext, signIn, ssoStepUp, type Req } from './routes.ts';
 
 // (sprint 130, SEC-3) The second step of signing in to an application, and "Two-step sign-in" on My account.
 //
@@ -34,6 +35,9 @@ import { appWithLocale, completeLogin, loadContext, rootAttrs, safeNext, signIn,
 // and on My account, also as the first factor a user adds while signing in; a code by e-mail when the application
 // allows it, for users who have another factor; step-up: a signed-in user whose page needs a more recent second step
 // comes here with ?next= and goes back after it (the session's __MFA_AT); and My account → REST API token.
+//
+// (sprint 132, SEC-4) A session signed in through an identity provider steps up there instead: the provider signs the
+// user in again with a second factor (sso.ts, saml.ts), unless the provider leaves the second step to pgkiln.
 
 const PENDING = '__MFA';
 const STEP_SECONDS = 300;
@@ -228,6 +232,15 @@ async function locked(reply: FastifyReply, a: App, locale: Locale, s: Session, p
   return reply.code(429).type('text/html').send(card(a, locale, locale.t('mfa.step_title'), alert(locale.t('login.throttled', { minutes: loginWindowMinutes() }))));
 }
 
+/** (sprint 132) The identity provider a step-up goes back to: the one the session signed in with, if it decides itself. */
+async function stepUpProvider(a: App, s: Session): Promise<Provider | null> {
+  const method = String(s.state.__SIGNIN ?? '');
+  if (!method.startsWith('sso:')) return null;
+  const name = method.slice(4).replace(/\+2fa$/, '');
+  const p = a.sso_providers.includes(name) ? await loadProvider(name) : undefined;
+  return p && !p.local_second_step ? p : null;
+}
+
 export async function twoStepRoutes(app: FastifyInstance) {
   app.get('/a/:alias/login/2fa', async (req: Req, reply) => {
     const r = await start(req, reply);
@@ -237,6 +250,13 @@ export async function twoStepRoutes(app: FastifyInstance) {
     // (sprint 131) step-up: a signed-in user sent here by a page that needs a more recent second step
     const next = typeof (req.query as { next?: unknown }).next === 'string' ? String((req.query as { next: string }).next).slice(0, 2000) : undefined;
     if (s.username && (!p || (next && p.next !== next))) {
+      const via = await stepUpProvider(a, s);
+      if (via)
+        return ssoStepUp(reply, a, s, via, next ?? `/a/${a.alias}/${a.home_page}`).catch((e) => {
+          req.log.warn({ err: e }, 'sso step-up failed');
+          return reply.code(502).type('text/html').send(card(a, locale, locale.t('mfa.stepup_title'),
+            alert(locale.t('login.sso_unavailable', { provider: via.display_name })), `/a/${a.alias}/${a.home_page}`));
+        });
       const id = await accountId(s.username);
       if (id === null || !(await accountHasFactor(id)))
         return reply.code(403).type('text/html').send(card(a, locale, locale.t('mfa.stepup_title'),

package/src/saml.ts

@@ -1,7 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { SAML, ValidateInResponseTo, type CacheProvider, type Profile } from '@node-saml/node-saml';
 import { owner } from './db.ts';
-import { publicUrl, resolveAccount, sha256, SsoError, usableUsername, type Provider, type SsoResult } from './sso.ts';
+import { MFA_REFUSED, mfaRequest, provedMfa, publicUrl, resolveAccount, sha256, SsoError, stepUpResult, usableUsername, type Provider, type SsoResult } from './sso.ts';
 
 // SAML 2.0 sign-in (APEX: SAML Sign-In), service-provider initiated:
 //
@@ -18,6 +18,9 @@ import { publicUrl, resolveAccount, sha256, SsoError, usableUsername, type Provi
 // answer an AuthnRequest of this flow, once. On top: the assertion's issuer
 // (node-saml doesn't check it for responses), the one-time state and the browser
 // that started the flow (as for OpenID Connect).
+// (sprint 132, SEC-4) The assertion's AuthnContextClassRef tells how the user signed in: with mfa_required it must
+// be one of the provider's mfa_values; mfa_request asks for those (RequestedAuthnContext); a step-up adds ForceAuthn
+// and checks the AuthnInstant.
 
 const PENDING_MINUTES = 10;
 const b64url = (b: Buffer) => b.toString('base64url');
@@ -54,8 +57,9 @@ function requestCache(onSave: (id: string) => void, only?: string): CacheProvide
   };
 }
 
-function client(p: Provider, cache: CacheProvider) {
+function client(p: Provider, cache: CacheProvider, stepup = false) {
   if (!p.idp_sso_url || !p.idp_cert) throw new SsoError('The SAML provider is not configured completely.');
+  const requested = mfaRequest(p);
   return new SAML({
     entryPoint: p.idp_sso_url,
     issuer: spEntityId(p),
@@ -69,37 +73,51 @@ function client(p: Provider, cache: CacheProvider) {
     requestIdExpirationPeriodMs: PENDING_MINUTES * 60_000,
     cacheProvider: cache,
     identifierFormat: null,
-    disableRequestedAuthnContext: true,
+    // (sprint 132) a RequestedAuthnContext only when the administrator names the classes
+    disableRequestedAuthnContext: !requested.length,
+    authnContext: requested,
+    racComparison: 'exact',
+    forceAuthn: stepup,
     acceptedClockSkewMs: 60_000,
     signatureAlgorithm: 'sha256',
   });
 }
 
 /** Start: the IdP URL with the AuthnRequest, and the browser-binding cookie value. */
-export async function startSamlSignIn(p: Provider, appId: number | null, next: string | undefined, link?: string) {
+export async function startSamlSignIn(p: Provider, appId: number | null, next: string | undefined, link?: string, stepup?: string) {
   const state = b64url(randomBytes(32));
   const browserKey = b64url(randomBytes(32));
   await owner.query(`delete from meta.sso_pending where created_at < now() - make_interval(mins => $1)`, [PENDING_MINUTES]);
   await owner.query(`delete from meta.saml_request where created_at < now() - make_interval(mins => $1)`, [PENDING_MINUTES]);
   let requestId = '';
-  const url = await client(p, requestCache((id) => (requestId = id))).getAuthorizeUrlAsync(state, undefined, {});
+  const url = await client(p, requestCache((id) => (requestId = id)), !!stepup).getAuthorizeUrlAsync(state, undefined, {});
   if (!requestId) throw new SsoError('The AuthnRequest has no ID.');
   // code_verifier is unused for SAML; nonce holds the AuthnRequest ID the response must answer
   await owner.query(
-    `insert into meta.sso_pending (state, app_id, provider_id, code_verifier, nonce, browser_hash, next, link_username)
-     values ($1, $2, $3, '', $4, $5, $6, $7)`,
-    [state, appId, p.id, requestId, sha256(browserKey), next ?? null, link ?? null],
+    `insert into meta.sso_pending (state, app_id, provider_id, code_verifier, nonce, browser_hash, next, link_username, stepup_session)
+     values ($1, $2, $3, '', $4, $5, $6, $7, $8)`,
+    [state, appId, p.id, requestId, sha256(browserKey), next ?? null, link ?? null, stepup ?? null],
   );
   return { url, browserKey };
 }
 
+/** (sprint 132) The signed assertion's AuthnContextClassRefs and AuthnInstant (ms), read after node-saml checked it. */
+export function authnContext(assertionXml: string): { classes: string[]; at: number | null } {
+  // comments are outside the signature (exclusive c14n drops them): text split by one is read as one
+  assertionXml = assertionXml.replace(/<!--[\s\S]*?-->/g, '');
+  const classes = [...assertionXml.matchAll(/<(?:[\w-]+:)?AuthnContextClassRef\b[^>]*>\s*([^<\s]+)\s*</g)].map((m) => m[1]);
+  const instant = /<(?:[\w-]+:)?AuthnStatement\b[^>]*\bAuthnInstant="([^"]+)"/.exec(assertionXml)?.[1];
+  const at = instant ? Date.parse(instant) : NaN;
+  return { classes, at: Number.isFinite(at) ? at : null };
+}
+
 const values = (v: unknown): string[] => (v === undefined || v === null ? [] : (Array.isArray(v) ? v : [v]).map(String).filter(Boolean));
 
 /** Finish: check state, browser and the response; the account and its groups. */
 export async function finishSamlSignIn(p: Provider, body: { SAMLResponse?: string; RelayState?: string }, browserKey: string | undefined): Promise<SsoResult> {
   const pending = await owner.one(
     `delete from meta.sso_pending where state = $1 and provider_id = $2 and created_at > now() - make_interval(mins => $3)
-     returning app_id, nonce, browser_hash, next, link_username`,
+     returning app_id, nonce, browser_hash, next, link_username, stepup_session`,
     [body.RelayState ?? '', p.id, PENDING_MINUTES],
   );
   if (!pending) throw new SsoError('This sign-in has expired or was already used. Please try again.');
@@ -115,6 +133,11 @@ export async function finishSamlSignIn(p: Provider, body: { SAMLResponse?: strin
   // node-saml checks the issuer of logout messages only: the assertion must come from the configured IdP
   if (profile?.issuer !== p.issuer) throw new SsoError(`The SAML response comes from ${profile?.issuer ?? 'an unknown issuer'}, not from ${p.issuer}.`);
   if (!profile?.nameID) throw new SsoError('The SAML response names no user.');
+  // (sprint 132, SEC-4) how the user signed in
+  const how = authnContext(profile.getAssertionXml?.() ?? '');
+  const mfa = provedMfa(p, how.classes);
+  if (pending.stepup_session) return stepUpResult(p, pending, profile.nameID, mfa, how.at);
+  if (p.mfa_required && !mfa) throw new SsoError(MFA_REFUSED);
   const username = p.username_claim === 'nameID' ? profile.nameID : values(profile[p.username_claim])[0];
   if (!usableUsername(username)) throw new SsoError(`The SAML response has no usable "${p.username_claim}" attribute.`);
   const name = values(profile.displayName ?? profile.cn)[0];
@@ -122,9 +145,9 @@ export async function finishSamlSignIn(p: Provider, body: { SAMLResponse?: strin
   const groups = values(profile[p.groups_claim]);
   if (pending.app_id === null)
     // the builder: devsso.ts finds the developer (sprint 129)
-    return { appId: null, next: pending.next, username, groups, link: pending.link_username, identity: { subject: profile.nameID, name: name ?? null, email: email ?? null, mayLink: true } };
+    return { appId: null, next: pending.next, username, groups, link: pending.link_username, mfa, identity: { subject: profile.nameID, name: name ?? null, email: email ?? null, mayLink: true } };
   const account = await resolveAccount(p, { sub: profile.nameID, name, email: profile.email ?? profile.mail }, username);
-  return { appId: pending.app_id, next: pending.next, username: account, groups };
+  return { appId: pending.app_id, next: pending.next, username: account, groups, mfa };
 }
 
 /** Service provider metadata (entity ID, ACS) to register pgkiln at the IdP. */

package/src/sso.ts

@@ -15,7 +15,9 @@ import { owner } from './db.ts';
 //    existing account is linked by username only when the provider allows
 //    it (link_existing), while it has no identity at that provider yet, and
 //    for the e-mail claim only with email_verified = true;
-//  * client secrets are read with the owner connection only.
+//  * client secrets are read with the owner connection only;
+//  * (sprint 132, SEC-4) with mfa_required, a sign-in counts only when the ID token's amr or acr names a second
+//    factor (mfa_values); a step-up asks the provider to sign the user in again and checks auth_time too.
 
 export interface Provider {
   id: number;
@@ -40,6 +42,14 @@ export interface Provider {
   builder_link_existing: boolean;
   builder_group: string | null;
   builder_admin_group: string | null;
+  /** (134, SEC-4) refuse sign-ins the provider does not mark as multi-factor */
+  mfa_required: boolean;
+  /** (134) acr_values / AuthnContextClassRef values to request, space separated */
+  mfa_request: string | null;
+  /** (134) amr / acr / AuthnContextClassRef values that count as a second factor */
+  mfa_values: string[];
+  /** (134) pgkiln asks its own second step after a sign-in through this provider */
+  local_second_step: boolean;
 }
 
 interface Discovery {
@@ -54,6 +64,8 @@ export class SsoError extends Error {}
 
 const ALGORITHMS = ['RS256', 'RS384', 'RS512', 'PS256', 'PS384', 'PS512', 'ES256', 'ES384', 'ES512', 'EdDSA'];
 const PENDING_MINUTES = 10;
+/** (sprint 132) A step-up through the provider: how old its new sign-in may be. */
+export const STEPUP_AUTH_SECONDS = 600;
 const b64url = (b: Buffer) => b.toString('base64url');
 export const sha256 = (s: string) => createHash('sha256').update(s).digest('hex');
 
@@ -92,11 +104,23 @@ function jwks(doc: Discovery) {
   return set;
 }
 
+/** (sprint 132) What the provider is asked for: its acr values (or AuthnContextClassRefs), split. */
+export const mfaRequest = (p: Pick<Provider, 'mfa_request'>) => (p.mfa_request ?? '').split(/\s+/).filter(Boolean);
+
+/** (sprint 132, SEC-4) Whether the provider says a second factor was used: one of its mfa_values among these. */
+export function provedMfa(p: Pick<Provider, 'mfa_values'>, said: string[]): boolean {
+  const accepted = new Set(p.mfa_values ?? []);
+  return said.some((v) => accepted.has(v));
+}
+
+export const MFA_REFUSED = 'The identity provider did not confirm a second factor (multi-factor sign-in), which this sign-in requires. Ask an administrator how to set one up at the identity provider.';
+
 /**
  * Start: returns the provider URL to redirect to, and the browser-binding cookie value.
- * appId null: a sign-in to the builder; link: the signed-in developer linking this identity.
+ * appId null: a sign-in to the builder; link: the signed-in developer linking this identity;
+ * stepup (sprint 132): the signed-in session a fresh multi-factor sign-in at the provider confirms.
  */
-export async function startSignIn(p: Provider, appId: number | null, next: string | undefined, link?: string) {
+export async function startSignIn(p: Provider, appId: number | null, next: string | undefined, link?: string, stepup?: string) {
   const doc = await discover(p.issuer);
   const state = b64url(randomBytes(32));
   const nonce = b64url(randomBytes(32));
@@ -104,12 +128,12 @@ export async function startSignIn(p: Provider, appId: number | null, next: strin
   const browserKey = b64url(randomBytes(32));
   await owner.query(`delete from meta.sso_pending where created_at < now() - make_interval(mins => $1)`, [PENDING_MINUTES]);
   await owner.query(
-    `insert into meta.sso_pending (state, app_id, provider_id, code_verifier, nonce, browser_hash, next, link_username)
-     values ($1, $2, $3, $4, $5, $6, $7, $8)`,
-    [state, appId, p.id, verifier, nonce, sha256(browserKey), next ?? null, link ?? null],
+    `insert into meta.sso_pending (state, app_id, provider_id, code_verifier, nonce, browser_hash, next, link_username, stepup_session)
+     values ($1, $2, $3, $4, $5, $6, $7, $8, $9)`,
+    [state, appId, p.id, verifier, nonce, sha256(browserKey), next ?? null, link ?? null, stepup ?? null],
   );
   const url = new URL(doc.authorization_endpoint);
-  url.search = new URLSearchParams({
+  const params = new URLSearchParams({
     response_type: 'code',
     client_id: p.client_id,
     redirect_uri: redirectUri(p),
@@ -118,7 +142,15 @@ export async function startSignIn(p: Provider, appId: number | null, next: strin
     nonce,
     code_challenge: b64url(createHash('sha256').update(verifier).digest()),
     code_challenge_method: 'S256',
-  }).toString();
+  });
+  // (sprint 132) what the provider should ask for; a step-up signs the user in again
+  const acr = mfaRequest(p);
+  if (acr.length) params.set('acr_values', acr.join(' '));
+  if (stepup) {
+    params.set('prompt', 'login');
+    params.set('max_age', '0');
+  }
+  url.search = params.toString();
   return { url: url.toString(), browserKey };
 }
 
@@ -145,6 +177,10 @@ export interface SsoResult {
   identity?: { subject: string; name: string | null; email: string | null; mayLink: boolean };
   /** builder: the signed-in developer who links this identity (Security page) */
   link?: string | null;
+  /** (sprint 132) the provider said a second factor was used (amr / acr, AuthnContextClassRef) */
+  mfa?: boolean;
+  /** (sprint 132) a step-up: the signed-in session this sign-in confirms (username: that session's account) */
+  stepup?: string | null;
 }
 
 /** Callback: validate state/browser, exchange the code, verify the ID token, resolve the account. */
@@ -154,7 +190,7 @@ export async function finishSignIn(p: Provider, params: URLSearchParams, browser
   const code = params.get('code') ?? '';
   const pending = await owner.one(
     `delete from meta.sso_pending where state = $1 and provider_id = $2 and created_at > now() - make_interval(mins => $3)
-     returning app_id, code_verifier, nonce, browser_hash, next, link_username`,
+     returning app_id, code_verifier, nonce, browser_hash, next, link_username, stepup_session`,
     [state, p.id, PENDING_MINUTES],
   );
   if (!pending) throw new SsoError('This sign-in link has expired or was already used. Please try again.');
@@ -198,6 +234,12 @@ export async function finishSignIn(p: Provider, params: URLSearchParams, browser
   const username = claim(payload, p.username_claim);
   if (!usableUsername(username)) throw new SsoError(`The identity token has no usable "${p.username_claim}" claim.`);
   if (p.username_claim === 'email' && payload.email_verified === false) throw new SsoError('Your e-mail address is not verified at the identity provider.');
+  // (sprint 132, SEC-4) how the user signed in: RFC 8176 amr values and the acr
+  const amr = Array.isArray(payload.amr) ? payload.amr.filter((v): v is string => typeof v === 'string') : [];
+  const mfa = provedMfa(p, typeof payload.acr === 'string' ? [...amr, payload.acr] : amr);
+  if (pending.stepup_session)
+    return stepUpResult(p, pending, payload.sub, mfa, typeof payload.auth_time === 'number' ? payload.auth_time * 1000 : null);
+  if (p.mfa_required && !mfa) throw new SsoError(MFA_REFUSED);
   const rawGroups = claim(payload, p.groups_claim);
   const groups = Array.isArray(rawGroups) ? rawGroups.filter((g): g is string => typeof g === 'string').map((g) => g.replace(/^\//, '')) : [];
 
@@ -207,12 +249,31 @@ export async function finishSignIn(p: Provider, params: URLSearchParams, browser
     // the builder: devsso.ts finds the developer (sprint 129)
     const email = payload.email_verified === false ? null : typeof payload.email === 'string' ? payload.email : null;
     return {
-      appId: null, next: pending.next, username, groups, link: pending.link_username,
+      appId: null, next: pending.next, username, groups, link: pending.link_username, mfa,
       identity: { subject: payload.sub, name: typeof payload.name === 'string' ? payload.name : null, email, mayLink: verified },
     };
   }
   const account = await resolveAccount(p, payload, username, { mayLink: verified });
-  return { appId: pending.app_id, next: pending.next, username: account, groups };
+  return { appId: pending.app_id, next: pending.next, username: account, groups, mfa };
+}
+
+/**
+ * (sprint 132) The end of a step-up through the provider (OpenID Connect or SAML): a new sign-in (at most
+ * STEPUP_AUTH_SECONDS old) with a second factor, by the identity already linked to the session's account.
+ * Nothing is created or linked here.
+ */
+export async function stepUpResult(
+  p: Pick<Provider, 'id' | 'mfa_values'>, pending: { app_id: number | null; next: string | null; stepup_session: string },
+  subject: string, mfa: boolean, authAt: number | null,
+): Promise<SsoResult> {
+  if (!mfa) throw new SsoError(MFA_REFUSED);
+  if (authAt === null || Date.now() - authAt > STEPUP_AUTH_SECONDS * 1000 + 60_000)
+    throw new SsoError('The identity provider did not ask you to sign in again. Please try again.');
+  const acc = await owner.one<{ username: string }>(
+    `select a.username from meta.account_identity i join meta.account a on a.id = i.account_id
+      where i.provider_id = $1 and i.subject = $2 and a.active`, [p.id, subject]);
+  if (!acc) throw new SsoError('This identity is not linked to an account here.');
+  return { appId: pending.app_id, next: pending.next, username: acc.username, groups: [], mfa: true, stepup: pending.stepup_session };
 }
 
 /** A username from an identity provider: text without white space or colons, at most 100 characters. */