Multi-factor authentication

A method, comprising:

• receiving, on a principal device, a token as an authentication taken for an initiated session between a principal and a service that executes on a service device, wherein receiving further includes receiving the token from an identity provider device that executes an identity provider;
• notifying, by the principal device, the identity provider over an out-of-band communication Channel of the token and the session by providing the identity provider a session key for the session, the token, and a hook to interact with the method over the out-of-band communication channel;
• obtaining, by the principal device, an instruction from the identity provider over the out-of-band communication channel to obtain a credential from the principal during the session;
• interacting, by the principal device, with the principal for obtaining the credential;
• and
• providing, by the principal device, the credential to the identity provider over the out-of-band communication channel for the identity provider to upgrade existing permissions associated with the token during the session without changing the token based on verification of the credential by the identity provider that was processed over the out-of-band communication channel during the session.

A device, comprising:

• a hardware processor;
• and
• a non-transitory computer-readable storage medium including executable instructions executable by the hardware processor to:
• provide a token as an authentication token for a principal that operates a principal device and a service that executes on a service device to establish a session with one another using a first set of permissions, wherein the token is linked to the first set of permissions;
• obtain a session key for the session and obtain a hook to a principal service that executes on the principal device;
• utilize a back channel of communication to the principal service using the hook to obtain a credential for the principal during the session when the principal attempts to access a resource during the session that the first set of permissions lack access rights to access for the session and
• upgrade the first set of permissions to a second set of permissions for the session using the session key without changing the token for the session when the credential provided over the back channel is successfully validated.