MFA: OTP verification over RADIUS

[Etienne Dysli-Metref]

Working with IT folks at the University of Geneva, who have a use case
for stronger [than password] authentication, I'm currently developing a
login flow (still 3.2-style, I know...) that verifies the second
authentication factor over RADIUS.

The advantages are:
1) no need to implement OTP verification logic, it's all in the
authentication server which provides the RADIUS interface
2) multiple token support, whatever your authentication server supports
(OATH-TOTP, SMS OTP, Yubikey, etc.), with only one login flow
3) deployer flexibility: they could replace their authentication server
with another one which also speaks RADIUS

If you guys want to check it out, it should be publicly available at
https://gitlab.switch.ch/etienne.dysli-metref/idpv3-mfa
I'm open to comments, however it's not finished so don't expect it to be
perfect. ;)

Would a "RADIUS validator" (beside LDAP and JAAS) be something you'd
consider useful to have in the IdP in the future?

  Etienne


PS: one caveat about RADIUS and Java
There are currently two open source Java libraries for RADIUS that I
could find: jradius and TinyRadius. Both are fairly old code (Java 1.4
era for TinyRadius) and neither seem actively maintained. So ugliness
and maintenance await...

-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 819 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/dev/attachments/20161019/68b67697/attachment.sig>