RFC extensions to Shibboleth

[Andrea Biancini]

Mike, thanks for the suggestions.
WebSSO (which I didn't know) seems very promising and interesting.

Regarding Duo Security solution, let me check if I understood correctly.
With their solution the linux boxes use regular PAM authentication (to
which a second mean of user identity verification is added). This implies
that the linux boxes must have a list of valid users (and also must be able
to manage their passwords for authentication). Isn't it?

What we tried to realize with our implementation is a solution in which the
linux box do not have to manage user information which are retrieved by
Shibboleth.
The overall scheme of our implementation is similar to the one used to
authenticate Linux users directly on LDAP (for which modules for PAM and
NSS exist).

On Tue, Sep 4, 2012 at 3:51 PM, Michael Schwartz <mike at gluu.org> wrote:

>
> Andrea,
>
> Very interesting!
>
> You should look at the excellent work done by Red Hat for the WebSSO
> project which has a similar goal:
>    http://websso.github.com
> Even though the name is "WebSSO", it uses SSL as transport... its really
> for non-web applications.
>
> Duo Security has a clever Linux integration. They let the normal PAM unix
> authentication proceed as normal. This is the first factor. On login, they
> run a script on the .profile that allows you to select the second factor:
> i.e. HTTP Push to your mobile, SMS or phone call. You could take a similar
> approach with Shib.
>
> thx,
>
> Mike
>
>
>
> -------------------------------------
> Michael Schwartz
> Gluu
> Founder / CEO
>
> On Tue, 4 Sep 2012, Andrea Biancini wrote:
>
> > Hi all,
> > I'm writing to describe and request comments about some extensions to
> > Shibboleth auth methods we've been working on.
> > The three extensions are:
> >
> >   1. *An extension to permit the authentication of non web-based
> >   applications.*
> >   To achieve this result we have developed some library to permit the
> >   authentication of non web-based application.
> >   These libraries are written for Java and Pyhton and use the Basic
> >   Authentication login handler of Shibboleth.
> >
> >   2. *Integration of Shibboleth as mean of authentication for Linux
> users.*
> >   We have developed a PAM and a NSS module to permit linux boxes to
> >   authenticate users via Shibboleth by requesting username+password and
> using
> >   the Basic Authentication login module.
> >
> >   3. *An extension to permit the authentication with S3 authentication
> >   schemes.*
> >   We have developed a specific login handler to implement the
> >   authentication mechanisms of the Amazon S3 protocol.
> >
> > All the code written is available on github at this link:
> > https://github.com/biancini/Shibboleth-Authentication
> >
> > We would really appreciate feedback on the work done in order to
> understand
> > with the community if the direction taken is good or if some review may
> be
> > suggested.
> > Thanks and regards,
> >
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20120904/a7c3bc7d/attachment.html