OTP loginhandler

[Schwoerer, Brad]

We are working with Unicon to develop a login flow that works with Symantec VIP including their Push Authentication and Risk Based Authentication.  Our intention is to open source it, but I am not sure yet what the steps are for the University to ok the open sourcing it.


-Bradley






On 10/16/15, 12:09 PM, "dev on behalf of Cantor, Scott" <dev-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

>> Is there any currently, or in near future, plans for a general OTP loginhandler?
>
>Not in those exact terms. After 3.2.0 ships, we have to start working on a framework for running composite login flows. Assuming you mean OATH, that's a SFA method like Duo that has to be combined with a password step, and unlike Duo it's not proprietary, so including a TOTP (or less likely HOTP) flow in the box would make sense.
>
>In practice, people don't use that sort of thing much. Convincing management to do for free what you can pay companies thousands of dollars to do sadly doesn't go the way you think it would.
> 
>> If not them I would like some tips and tricks before I start developing one myself.
>
>I don't have any documentation on writing login flows. We have several already implemented, the SPNEGO flow is coming shortly, and there's always using External to implement the new logic in a servlet.
> 
>> I am mostly interested in the loginhandler itself as the infrastructure behind
>> it is relatively simple.
>
>Writing login flows is quite simple, and writing servlets using the External interface is simpler.
>
>-- Scott
>
>-- 
>To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net