Mike, thanks for the suggestions.<div>WebSSO (which I didn't know) seems very promising and interesting.</div><div><br></div><div>Regarding Duo Security solution, let me check if I understood correctly.</div><div>With their solution the linux boxes use regular PAM authentication (to which a second mean of user identity verification is added). This implies that the linux boxes must have a list of valid users (and also must be able to manage their passwords for authentication). Isn't it?</div>
<div><br></div><div>What we tried to realize with our implementation is a solution in which the linux box do not have to manage user information which are retrieved by Shibboleth.</div><div>The overall scheme of our implementation is similar to the one used to authenticate Linux users directly on LDAP (for which modules for PAM and NSS exist).<br>
<br><div class="gmail_quote">On Tue, Sep 4, 2012 at 3:51 PM, Michael Schwartz <span dir="ltr"><<a href="mailto:mike@gluu.org" target="_blank">mike@gluu.org</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Andrea,<br>
<br>
Very interesting!<br>
<br>
You should look at the excellent work done by Red Hat for the WebSSO<br>
project which has a similar goal:<br>
<a href="http://websso.github.com" target="_blank">http://websso.github.com</a><br>
Even though the name is "WebSSO", it uses SSL as transport... its really<br>
for non-web applications.<br>
<br>
Duo Security has a clever Linux integration. They let the normal PAM unix<br>
authentication proceed as normal. This is the first factor. On login, they<br>
run a script on the .profile that allows you to select the second factor:<br>
i.e. HTTP Push to your mobile, SMS or phone call. You could take a similar<br>
approach with Shib.<br>
<br>
thx,<br>
<br>
Mike<br>
<br>
<br>
<br>
-------------------------------------<br>
Michael Schwartz<br>
Gluu<br>
Founder / CEO<br>
<div class="im"><br>
On Tue, 4 Sep 2012, Andrea Biancini wrote:<br>
<br>
> Hi all,<br>
> I'm writing to describe and request comments about some extensions to<br>
> Shibboleth auth methods we've been working on.<br>
> The three extensions are:<br>
><br>
</div>> 1. *An extension to permit the authentication of non web-based<br>
> applications.*<br>
<div class="im">> To achieve this result we have developed some library to permit the<br>
> authentication of non web-based application.<br>
> These libraries are written for Java and Pyhton and use the Basic<br>
> Authentication login handler of Shibboleth.<br>
><br>
</div>> 2. *Integration of Shibboleth as mean of authentication for Linux users.*<br>
<div class="im">> We have developed a PAM and a NSS module to permit linux boxes to<br>
> authenticate users via Shibboleth by requesting username+password and using<br>
> the Basic Authentication login module.<br>
><br>
</div>> 3. *An extension to permit the authentication with S3 authentication<br>
> schemes.*<br>
<div class="im HOEnZb">> We have developed a specific login handler to implement the<br>
> authentication mechanisms of the Amazon S3 protocol.<br>
><br>
> All the code written is available on github at this link:<br>
> <a href="https://github.com/biancini/Shibboleth-Authentication" target="_blank">https://github.com/biancini/Shibboleth-Authentication</a><br>
><br>
> We would really appreciate feedback on the work done in order to understand<br>
> with the community if the direction taken is good or if some review may be<br>
> suggested.<br>
> Thanks and regards,<br>
><br>
</div><div class="HOEnZb"><div class="h5">--<br>
To unsubscribe from this list send an email to <a href="mailto:dev-unsubscribe@shibboleth.net">dev-unsubscribe@shibboleth.net</a><br>
<br>
</div></div></blockquote></div><br></div>