Two factor authentication for shibboleth

[Cantor, Scott]

On 11/7/13, 2:54 PM, "Jared Hoffman" <hoffmanj at kenyon.edu> wrote:
>
>Now we've got a working trial of RSA two-factor with our VPN. We've got
>the RSA Authentication Manager v8 and the Web Tier running as a test with
>our Cisco VPN. We're trying to integrate RSA with shibboleth,
> but we're not sure how to get our idp server to use RSA server to
>authenticate. RSA has directed us to the Multi Factor Login Handler link
>below, but our technical contacts have not been able to give any
>instruction or documentation beyond this link.

That definitely has nothing to do with RSA. It's for taking a non-MFA
solution (Yubikey) and marrying it to a second factor.

I have no idea why RSA would direct you to that.

RSA's Java SDK for SecurID comes with a JAAS login module for SecurID. It
plugs directly into the IdP's UsernamePassword handler and can be cascaded
via JAAS config with other password options.

I took their JAAS sample and created my own version that added a couple of
features and I eventually threw it into the Shibboleth repository.

http://svn.shibboleth.net/view/extensions/java-jaas-securid/

It's not very well kept, but the code is there.

You can't get the securid.jar file needed from anybody but RSA, via their
Java SDK. If you can't get that, I can't give it to you, it's not open
source.

The Java toolkit works fine with the IdP's environment in terms of
configuration, you just point the JAAS module entry at the properties file
that configures the rest of it, and you have some other files needed for
your host, like the nodesecret.

My JAAS module config is like this:

ShibSecurIDAuth {
	edu.internet2.middleware.shibboleth.jaas.securid.SecurIDLoginModule
required
	roleName="SecurID" pwRegex="^\\S{1,8}\\d{6}$"
	properties="/opt/jetty/etc/securid.properties";
};

The properties file is from the SDK and is set up per their instructions.


The major problem with their code is that they hardwired the securid.jar
to use log4j for logging, and they uses classes that make it impossible to
shim the logging with the log4j/slf4j shim. So you can't get logs to one
place, and you can have issues with container logging getting screwed up
by the need to put log4j into the picture. It takes some playing around
and expertise with Java logging and container configuration.

-- Scott