OTP verification over RADIUS

[Cantor, Scott]

> Would a "RADIUS validator" (beside LDAP and JAAS) be something you'd
> consider useful to have in the IdP in the future?

In principle, yes, but RADIUS over UDP is pretty lousy security-wise, and from your other comment, doesn't sound like RADSEC is there.

Generally speaking I would also just do a JAAS module for something like this, there isn't tremendous value in making it specific to the IdP. If the interface is just username + password, there's not much reason I can see not to just use JAAS.

> PS: one caveat about RADIUS and Java
> There are currently two open source Java libraries for RADIUS that I
> could find: jradius and TinyRadius. Both are fairly old code (Java 1.4
> era for TinyRadius) and neither seem actively maintained. So ugliness
> and maintenance await...

That would probably be a problem for me. We don't rely on unsupported libraries and I don't think maintaining our own RADIUS code is practical. If a third party adopted one of them and supported it long term, obviously that might change things. Perhaps there's some kind if go-between layer that could be used to get access to a more maintained RADIUS client.

-- Scott