Step-Up Authentication vs 2FA: Implementing Additional Verification for Sensitive Operations in Corporate Systems

Two-factor authentication (2FA) has become a standard for protecting corporate systems, yet it often proves insufficient for handling personal data or other high-risk operations. While 2FA verifies identity only at login and then grants access for the duration of the trusted session, modern attacks increasingly target already-active sessions. This limitation prompted the adoption of Step-Up Authentication, which requests additional confirmation precisely when a user attempts a sensitive action.

Why Standard 2FA Falls Short

Common second factors include SMS or Email OTP, TOTP from authenticator apps such as Yandex Key, Google Authenticator, Microsoft Authenticator, or Authy, and other one-time codes. These methods protect the login process effectively but do not re-verify identity during an ongoing session. As a result, prolonged sessions or shared devices can expose critical resources without further checks.

What Step-Up Authentication Provides

Step-Up Authentication differs by triggering extra verification only at the point of elevated-risk operations. Typical scenarios include work on shared devices, long-lived sessions, or access requests that demand a higher trust level than the initial login provided. In the described project, this mechanism was applied specifically when users attempted to retrieve salary information, requiring re-authentication only for selected APIs.

The technical foundation relies on ACR (Authentication Context Class Reference) values embedded in tokens. These values indicate whether login occurred with password alone or with an additional OTP. Applications inspect the ACR claim and either grant access or redirect the user for further authentication.

Project Implementation Challenges and Solution

Although Keycloak and WSO2 both support Step-Up Authentication out of the box, the project’s business requirements exceeded standard capabilities. The PIN code had to remain valid for six months, external systems needed to treat it as a user password, and verification had to occur at a separate gateway layer independent of the Identity Provider. These constraints made heavy customization of WSO2 impractical.

The team therefore created an independent PIN-code service and a dedicated gateway-2fa microservice. Only requests to protected APIs pass through this gateway; all other traffic follows the normal route. The flow works as follows:

• The web application directs the user to the PIN service to generate a code.
• The service creates an encrypted PIN, stores it, and delivers it via email and SMS.
• After successful entry, the service issues a signed cookie with a defined TTL confirming Step-Up completion.
• On subsequent protected calls, gateway-2fa validates the cookie and cross-checks key JWT fields; mismatches result in denial of access.

User Experience and Monitoring

From the user’s perspective, the additional step appears only when accessing protected data. A 401 response prompts PIN entry; successful validation sets the cookie, after which the user can work with sensitive resources until the TTL expires (set to 20 minutes in this implementation). Incorrect PIN attempts simply keep the resource inaccessible.

Usage statistics are collected in Matomo and technical metrics in ELK, enabling early detection of performance issues or unusual patterns.

Key Considerations for Deployment

Successful rollout requires careful definition of TTL duration, strong encryption for stored PINs, load testing of the additional service, and logging that supports incident investigation without exposing sensitive user data. The resulting architecture strengthens protection for critical operations while preserving a seamless login experience and supporting Zero Trust principles.