Shibboleth - Query on integrating two factor authentication

[badri]

Hi Kevin,

Thanks for your comments and the concept is much clear now.

So I understand that we have to have a separate directory protected with
Apache (using mod_authn_otp) with a index.html having text "Authenticated
OK" and this is used only by the login handler at Identity provider for OTP
factor.

And "AuthType Shibboleth" for any other directory for protecting and it
will redirect to IDP auth page while anyone tries accessing this directory
where the user touch the multi factor login handler.

I will try they way you have said and will probe any questions if I have.
Thanks a bunch again.

- Badri

On Wed, 11 Apr 2012 10:35:46 -0400 (EDT), "Kevin P. Foote"
<kpfoote at iup.edu> wrote:
> According to my interpretation and setup your statement is incorrect.
> 
> Your Multi-Factor Login Handler (IdP portion) is expecting the output of
> that page .. "Authenticated
> OK" to be returned from the validation step of your mod_authn_otp
protected
> directory.
> 
> You need to enable a dir through apache that requires the otp module to
> be executed and "something" (your token) to be validated. 
> 
> ------
> thanks
>   kevin.foote
> 
> On Wed, 11 Apr 2012, Badri wrote:
> 
> -> Hi Kevin,
> -> 
> -> The exact thing we want to do is the two-factor authentication should
> be completely done in IDP (both LDAP and
> -> token) and IDP runs as a Tomcat application. Now the question is how
do
> I use this apache module to perform the
> -> token authentication which has to be done in the IDP side.
> -> 
> -> The secured directory in SP is protected like
> -> 
> -> <Directory "/var/www/html/oath-protected">
> -> AuthType Shibboleth
> -> ShibRequireSession On
> -> ShibApplicationId default
> -> ShibExportAssertion On
> -> Require Shibboleth
> -> </Directory>
> -> 
> -> 
> -> Thanks
> -> -Badri
> -> 
> -> Kevin P. Foote wrote:
> -> 
> -> Just a config question... 
> -> 
> -> Have you set up the www server (apache) such that the mod_auth_otp is
> -> enabled, used and being called?
> -> 
> -> This is referenced in the setup guide you are following under the
> -> OAUTH-HOTP example section.. 
> -> 
> -> ------
> -> thanks
> ->   kevin.foote
> -> 
> -> On Wed, 11 Apr 2012, Badri wrote:
> -> 
> -> -> Hi Shibboleth user group,
> -> -> 
> -> -> We have chosen Shibboleth for SSO and Two Factor Authentication
and
> implemented the SSO on our web server. W
> -> e
> -> -> have the Service Provider, Identity Provider, LDAP, Apache web
> server configured and the SSO works well in o
> -> ur
> -> -> web servers.
> -> -> Say for example, subdomain1.xxxx.com and subdomain2.xxxx.com works
> with Shibboleth's SSO connected with our 
> -> own
> -> -> LDAP authentication server.
> -> -> 
> -> -> Now we are in a need to implement Two factor authentication and
came
> to know the solution available in the
> -> -> documentation at
> -> ->
>
https://wiki.shibboleth.net/confluence/display/SHIB2/Multi+Factor+Login+Handler
> -> -> 
> -> -> We have followed this documentation and tried to add the TFA
feature
> to our server but it did not work
> -> -> properly. The Identity provider is rebuilt with the following jar
> files along with the configuration changes
> -> -> mentioned in the the documentations for files like
> -> -> web.xml, handler.xml, login.conf, logging.xml.
> -> -> 
> -> -> Yubico validation client :
yubico-validation-client-2.0-pre1-shib.jar
> -> -> Multifactor login handler :multifactor-login-handler-0.1.jar
> -> -> 
> -> -> Now we get the new login.jsp and it asks the "username",
"password"
> and "token" but the the token functional
> -> ity
> -> -> is not working. The authentication is successful with just the
ldap
> login.
> -> -> 
> -> -> Is there any advice you can give us on how to enable TFA in
> Shibboleth??? Also we would like to know how the
> -> -> apache module for otp works here and how a directory should be
> protected with multifactor auth?? The
> -> -> documentation I have pointed to uses AuthType basic.
> -> -> 
> -> -> Any advice would be much appreciated. Thanks
> -> -> 
> -> -> - Badri
> -> -> 
> -> -> 
> -> --
> -> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
> -> 
> ->      
>
___________________________________________________________________________________________________
> -> 
> -> 
> -> Internal Virus Database is out of date.
> -> Checked by AVG - www.avg.com 
> -> Version: 8.5.449 / Virus Database: 271.1.1/3765 - Release Date:
> 07/14/11 18:38:00
> -> 
> ->   
> -> 
> -> 
> -> 
> -> -- 
> -> Warm Regards,
> -> 
> -> K.BADRI NARAYANAN
> -> 
> -> 
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net