title: identityServer4 with Login Step-up and MFA
body: <p>In one of my Projects i need to implement Login Step-up. That means a user can login an application with simple username and password to get some readonly access access on website and API behind it.</p>
  
  <p>If user want to performan any sensetive data operations like "write/update", he need to authenticate via second factor (via SMS code).</p>
  
  <p>second factor login is for maximum 10 minutes valid, if user does not interect the website for 10 minuets, he will be automatically logout from second factor, but he still remain logged in with one factor.</p>
  
  <p>can identityserver4 support this szenario out of the box? or do i need to implement it by my own ? </p>
  
  <p><strong>Here is my solution proposal:</strong></p>
  
  <ul>
  <li>for one factor login, identityserver provide a one factor scope, which client need to understand. it provide a access token which also have limited scope.</li>
  <li>when client application need two factor scope, it call identityserver again where user must provide second factor authentication. hence a new token with second factor scope sent back to client. with this token client can call API methodes which need second factor authentication.</li>
  <li>second factor authentication token has a validity of 10 minutes</li>
  <li>after 10 min token is invalid, but one factor token is still valid as it has long life time.</li>
  </ul>
  
  <p><strong><em>Questions</em></strong>:</p>
  
  <p><strong>- Can IdentityServer4 offer Login Step-up out-of-box? if no, what are the alternative solutions ?</strong></p>
  
  <p><strong>what is your suggesstion regarding my solution proposal?</strong></p>
  
  <p>Thanks in Advance</p>