Shibboleth - Query on integrating two factor authentication

[Kevin P. Foote]

According to my interpretation and setup your statement is incorrect.

Your Multi-Factor Login Handler (IdP portion) is expecting the output of that page .. "Authenticated
OK" to be returned from the validation step of your mod_authn_otp protected
directory.

You need to enable a dir through apache that requires the otp module to
be executed and "something" (your token) to be validated. 

------
thanks
  kevin.foote

On Wed, 11 Apr 2012, Badri wrote:

-> Hi Kevin,
-> 
-> The exact thing we want to do is the two-factor authentication should be completely done in IDP (both LDAP and
-> token) and IDP runs as a Tomcat application. Now the question is how do I use this apache module to perform the
-> token authentication which has to be done in the IDP side.
-> 
-> The secured directory in SP is protected like
-> 
-> <Directory "/var/www/html/oath-protected">
-> AuthType Shibboleth
-> ShibRequireSession On
-> ShibApplicationId default
-> ShibExportAssertion On
-> Require Shibboleth
-> </Directory>
-> 
-> 
-> Thanks
-> -Badri
-> 
-> Kevin P. Foote wrote:
-> 
-> Just a config question... 
-> 
-> Have you set up the www server (apache) such that the mod_auth_otp is
-> enabled, used and being called?
-> 
-> This is referenced in the setup guide you are following under the
-> OAUTH-HOTP example section.. 
-> 
-> ------
-> thanks
->   kevin.foote
-> 
-> On Wed, 11 Apr 2012, Badri wrote:
-> 
-> -> Hi Shibboleth user group,
-> -> 
-> -> We have chosen Shibboleth for SSO and Two Factor Authentication and implemented the SSO on our web server. W
-> e
-> -> have the Service Provider, Identity Provider, LDAP, Apache web server configured and the SSO works well in o
-> ur
-> -> web servers.
-> -> Say for example, subdomain1.xxxx.com and subdomain2.xxxx.com works with Shibboleth's SSO connected with our 
-> own
-> -> LDAP authentication server.
-> -> 
-> -> Now we are in a need to implement Two factor authentication and came to know the solution available in the
-> -> documentation at
-> -> https://wiki.shibboleth.net/confluence/display/SHIB2/Multi+Factor+Login+Handler
-> -> 
-> -> We have followed this documentation and tried to add the TFA feature to our server but it did not work
-> -> properly. The Identity provider is rebuilt with the following jar files along with the configuration changes
-> -> mentioned in the the documentations for files like
-> -> web.xml, handler.xml, login.conf, logging.xml.
-> -> 
-> -> Yubico validation client : yubico-validation-client-2.0-pre1-shib.jar
-> -> Multifactor login handler :multifactor-login-handler-0.1.jar
-> -> 
-> -> Now we get the new login.jsp and it asks the "username", "password" and "token" but the the token functional
-> ity
-> -> is not working. The authentication is successful with just the ldap login.
-> -> 
-> -> Is there any advice you can give us on how to enable TFA in Shibboleth??? Also we would like to know how the
-> -> apache module for otp works here and how a directory should be protected with multifactor auth?? The
-> -> documentation I have pointed to uses AuthType basic.
-> -> 
-> -> Any advice would be much appreciated. Thanks
-> -> 
-> -> - Badri
-> -> 
-> -> 
-> --
-> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-> 
->       ___________________________________________________________________________________________________
-> 
-> 
-> Internal Virus Database is out of date.
-> Checked by AVG - www.avg.com 
-> Version: 8.5.449 / Virus Database: 271.1.1/3765 - Release Date: 07/14/11 18:38:00
-> 
->   
-> 
-> 
-> 
-> -- 
-> Warm Regards,
-> 
-> K.BADRI NARAYANAN
-> 
->