Assurance Enhancements for IdPv2

[William G. Thompson, Jr.]

Folks,

InCommon has released an RFP for Assurance and MFA Enhancements to
Shibboleth Identity Provider (IdPv2).

https://spaces.internet2.edu/display/InCAssurance/Request+for+Proposal+-+Assurance+and+MFA+Enhancements+to+Shibboleth+Identity+Provider

Unicon will be bidding on this work and would welcome input on early
thoughts on potential implementation paths.  This will help us (and
others) scope out the work more accurately.

The RFP envisions a component that will sit between the
AuthenticationEngine and various authentication methods that will
drive new user experience and system behavior required to the meet the
needs for InC IAP/MFA.

This new component, the Multi-Context Broker, would be deployed as a
traditional LoginHandler but would have a wider scope of
responsibility, including managing various authentication methods.

Our initial thought is first build a LoginHandler that is essentially
a bridge to SWF and then craft the MCB functionality there.

So the first question is, what do folks think of this approach generally?

Once in SWF, the thought occurred to us that we might be able to
leverage Spring Security or Shiro for primary authentication rather
than come up with a replacement for the LoginHandler API.  Thoughts?

Other thoughts about leveraging/reusing the existing LoginHandlers in
light of the MCB?   Does this seem feasible?

One key requirements is the ability to configure a mapping between
various AuthNContexts and their authentication methods as well as the
various AuthNContexts that would satisfy others (e.g. Silver satisfies
Bronze).  Thoughts on where/how to manage this configuration?

Any other thoughts on potential implementation paths, things that
could be particularly difficult, etc?

Best,
Bill