Feedback on Multi-Context Broker Community Contribution

[Wessel, Keith]

Paul,

This _might_ be of use to us at Illinois and possibly others in a similar situation to us.

We'll soon be switching away from the UsernamePassword login handler to the RemoteUser login handler to integrate with a new university-wide SSO system that's being put in place. In other words, Shib will be using the other SSO as authoritative. However, the other SSO doesn't currently have support for Duo which we're considering. And Duo's contributed login handler is only a drop-in replacement for the UsernamePassword login handler. Duo, at our request, has added modifying the RemoteUser login handler to do a Duo token auth after getting a username back from the RemoteUser login handler, but I don't think it's a high priority.

We'd love if we could somehow use your MCB work to use a Remoteuser login handler for basic or unspecified authn requests but use something from Duo for MFA requests. I'm not sure, after reading your docs, that this is doable, though. Thoughts or comments? Am I nuts here? :)

Keith


From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Paul Hethmon
Sent: Monday, October 21, 2013 3:27 PM
To: Shibboleth Users
Subject: Feedback on Multi-Context Broker Community Contribution

I've been working on a project for InCommon to provide a Shibboleth Authentication Handler that implements ordered levels of authentication. So you could configure both a simple password and a two-factor system inside of Shibboleth and then let the SP request which one to use. So if Joe User first authenticates with password, a second SP (or even the first for that matter), could then send an authentication request that says to use two-factor authentication. The Multi-Context Broker (MCB) would then force the user to "upgrade" their authentication to two-factor to continue.

That's the basics of what it can do. We've done some initial testing and are now looking to broaden our audience for more feedback. You can find all of the information on the Shibboleth wiki:

https://wiki.shibboleth.net/confluence/display/SHIB2/Multi-Context+Broker

Please take a look if you think this capability might be useful to you.

thanks,

Paul


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131021/9a98ef72/attachment-0001.html