RFC extensions to Shibboleth

[Michael Schwartz]

Andrea,

Very interesting!

You should look at the excellent work done by Red Hat for the WebSSO 
project which has a similar goal:
   http://websso.github.com
Even though the name is "WebSSO", it uses SSL as transport... its really 
for non-web applications.

Duo Security has a clever Linux integration. They let the normal PAM unix 
authentication proceed as normal. This is the first factor. On login, they 
run a script on the .profile that allows you to select the second factor: 
i.e. HTTP Push to your mobile, SMS or phone call. You could take a similar 
approach with Shib.

thx,

Mike



-------------------------------------
Michael Schwartz
Gluu
Founder / CEO

On Tue, 4 Sep 2012, Andrea Biancini wrote:

> Hi all,
> I'm writing to describe and request comments about some extensions to
> Shibboleth auth methods we've been working on.
> The three extensions are:
>
>   1. *An extension to permit the authentication of non web-based
>   applications.*
>   To achieve this result we have developed some library to permit the
>   authentication of non web-based application.
>   These libraries are written for Java and Pyhton and use the Basic
>   Authentication login handler of Shibboleth.
>
>   2. *Integration of Shibboleth as mean of authentication for Linux users.*
>   We have developed a PAM and a NSS module to permit linux boxes to
>   authenticate users via Shibboleth by requesting username+password and using
>   the Basic Authentication login module.
>
>   3. *An extension to permit the authentication with S3 authentication
>   schemes.*
>   We have developed a specific login handler to implement the
>   authentication mechanisms of the Amazon S3 protocol.
>
> All the code written is available on github at this link:
> https://github.com/biancini/Shibboleth-Authentication
>
> We would really appreciate feedback on the work done in order to understand
> with the community if the direction taken is good or if some review may be
> suggested.
> Thanks and regards,
>