RFC extensions to Shibboleth

[Russ Allbery]

Michael Schwartz <mike at gluu.org> writes:

> Duo Security has a clever Linux integration. They let the normal PAM
> unix authentication proceed as normal. This is the first factor. On
> login, they run a script on the .profile that allows you to select the
> second factor:  i.e. HTTP Push to your mobile, SMS or phone call. You
> could take a similar approach with Shib.

That seems insecure when done in .profile, by which point it's really too
late to be doing authorization.  What prevents the user from interrupting
the profile script with Ctrl-C to bypass the second factor?  What if the
user wants to run something non-interactively, at which point there's no
tty to use to prompt?

I wish people would not try to avoid writing a PAM module when what they
really want is a PAM module.  Writing a proper PAM module is just not that
hard.

-- 
Russ Allbery (rra at stanford.edu)             <http://www.eyrie.org/~eagle/>