Is Shibboleth a match to replace our multi-factor authentication system ?

[Patrick Rynhart]

Hi,

At our University we have an in-house developed multi-factor
authentication system, the purpose of which is to allow both current and
former students to log into a subset of our websites (e.g. Alumni).  On
such sites, we have a custom auth module / plug-in on such sites to
facilitate this process.

We are finding it difficult to maintain this system, and - as such -
would like to move towards a standard, enterprise class system as a
replacement.  I was wondering whether Shibboleth would be a potential
match as a technology ?

For authentication, the multi-factor system would first need to query
AD, then an SQL database, and possibly other data sources if both of
these fail.  Then relevant data would then need to be released to the
site concerned.

Some Questions
--------------

1. Most Shibboleth installation online appear to be for integration with
a Federation (InCommon, e.g.).  I believe that our arrangement is
simplier - a bilateral arrangement between an IdP and SdP.  If this is
correct, could someone please point me to a relevant HOWTO that would
help me to deploy a (minimal) proof-of-concept setup.  Initially I would
skip Multi-Factor and would seek to setup the simplest possible
arrangement for a Shib IdP to use AD as its Login Handler and for
attributes to then be released to our SdP.

2. Following this (to get the multi-factor portion working), is the
following the correct handler to use for multi-factor auth, or is there
a better approach ?

https://wiki.shibboleth.net/confluence/display/SHIB2/Multi+Factor+Login+Handler

Thank you in advance.

Regards,

Patrick

-- 

Patrick Rynhart
Systems Engineer (Infrastructure)
Information Technology Services
Massey University
NEW ZEALAND