title: Can I ask if the OpenID principal did pass a two-factor authentication?
body: <p>I'm designing an authentication scheme for a new project. People will be able to authenticate via Google / Facebook / Microsoft etc. accounts using <code>OpenID</code>. All these providers do support two-factor authentication.</p>
  
  <p>My goal is simple: when a user registers or logs in using an OpenID principal, I want to query the authentication service and tell if the user has enabled two factor authentication or not. If he did, and passed both steps, "Welcome user", else "Sorry buddy but this site is very secure and you must enable two-factor authentication".</p>
  
  <p><strong>Is that possible using current services?</strong> I have read <a href="https://developers.google.com/accounts/docs/OpenIDConnect" rel="nofollow">Google docs</a> and found nothing about it. Since the OpenID Connect does not support any "two-step authentication" attribute for the token, nor a "strength" attribute that may be exploited, I must rely on a specific profile API that might reveal such information. But I have found none yet at least in Google APIs.</p>