Design a Pre-Login Risk and Challenge Service

Design a service that determines, before a user authenticates, which challenges that user must complete. CAPTCHA is one possible challenge type. A prior discussion mentioned two operations: one assesses user risk and returns a list of required challenges, and another adds a challenge. Before defining the interfaces and authorization model, clarify what “adding a challenge” means. Part 1 — Assess risk and choose challenges What pre-authentication information can the service…