Support high assurance level

[bheesham]

Jira: IAM-1989

---

tl;dr: for some RPs we need to support a stricter policy for MFA. This PR adds support for HIGH.

[Copilot]

Pull request overview

Adds support for a stricter authenticator assurance policy (HIGH) in the accessRules Auth0 Action, along with Terraform secret wiring and test updates, to enable RPs to require stronger MFA characteristics.

Changes:

• Introduces an AAL→AAI mapping (including HIGH) and updates decision logic to select the highest AAL across matching authorization rules.
• Updates Duo configuration handling to select credentials based on the required AAL.
• Adjusts Jest tests to reflect new HIGH behavior (Duo treated as satisfying HARDWARE).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
tf/actions/accessRules.js	Adds HIGH AAL support, mapping/selection logic, and Duo config selection changes.
tf/tests/accessRules.test.js	Updates tests for the new HIGH behavior expectations.
tf/actions.tf	Renames/splits Duo Action secrets into medium/high variants for the Action runtime.

Comments suppressed due to low confidence (1)

tf/actions/accessRules.js:382

• For LDAP (strategy === "ad") users that require Duo, enableDuo is set but aai remains empty. That causes MEDIUM requirements to fail the AAI check (since AAI_MAPPING["MEDIUM"] is non-empty), denying access before the Duo challenge can be triggered. If enabling Duo is intended to satisfy MEDIUM, add the relevant AAI indicator(s) when enableDuo is set.

    // Allow certain LDAP service accounts to fake their MFA. For all other LDAPi accounts, enforce MFA
    if (event.connection.strategy === "ad") {
      // No support for HIGH or MAXIMUM assurance levels.
      if (mfaBypassAccounts.includes(event.user.email)) {
        console.log(
          `LDAP service account (${event.user.email}) is allowed to bypass MFA`
        );
        aai.add("2FA");
      } else {
        enableDuo = true;
        console.log(
          `duosecurity: ${event.user.email} is in LDAP and requires 2FA check`
        );
      }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.