Feedback on Multi-Context Broker Community Contribution

[Tom Scavo]

On Mon, Oct 21, 2013 at 5:00 PM, Paul Hethmon
<paul.hethmon at clareitysecurity.com> wrote:
>
> I just scanned the Duo handler and see how it's like the standard
> UserPassword handler, but I'm not picking up on what it is doing for the
> "Duo" authentication part.

It passes an identifier for the user to the Duo Service in the cloud.

> From looking at their website, it looks like the
> login at the IdP using normal JAAS mechanisms would trigger the push
> notification to the user's phone? Then if the user approves it, that somehow
> lets the IdP know to proceed with the authentication?

Here's a sequence diagram when using a Duo Mobile OTP:

http://www.websequencediagrams.com/cgi-bin/cdraw?lz=dGl0bGUgRGlzdHJpYnV0ZWQgMkZBIElkUCBQcm94eSAtIER1byBNb2JpbGUgSW50ZWdyYXRpb24KClVzZXItPlNQOiByZXNvdXJjZSByZXF1ZXN0Cm5vdGUgcmlnaHQgb2YgU1A6IFNQIGlzc3VlcwBaBWF1dGhuACUJU1AtPlVzZXI6IHJlZGlyZWN0IHRvAHkKAGIHAIEKCToAOgllbnRpYwCBCQUAcQkAgTAJAEsIZGlzY292ZXJ5IGludGVyZmFjZQCBEA8AdQZVc2VyIGNob29zZXMgSWRQAGQScHJlZmVycmVkABoFAIFVDiIAgigJIjoAgjILAIFsB0xvQS0xAIFmDwCBGBEAgXAMAF0OAIF3CToAPwsAgWYWAIJBCHVzZXJuYW1lL3Bhc3N3b3JkIGxvZ2luAIFgJACCTgtlcwBwDABCCXRva2VuAINVDwCBGQVJZACDXQkAgWUOc3BvbnNlAIEVDACDQycAgVkXAEkHAIJfJXZhbGlkYXQAfBgAgyImbml0aWFsaXplcwCGCgUAgkgFAIRgDER1byBTZXJ2aWNlOgCGLAVwcmUtAIVYDgAYCwCFQA0AHhAAgiIKAIU7DgBvCQCFJSRlbnRlcnMgT1QAhTUTb25lLXRpbWUAg0wFY29kAIIhJwCHVQcAUAUAgk0IaW8AgWgeAIFYKgCCYTUAiD8SAIIlGACITQxTAIdUCFNQAIg0FwCEShUAiT8HAIRFCgBlEwCJPgwAigoJAIV2Bw&s=napkin

Here's a sequence diagram when using Duo Push:

http://www.websequencediagrams.com/cgi-bin/cdraw?lz=dGl0bGUgRGlzdHJpYnV0ZWQgMkZBIElkUCBQcm94eSAtIER1byBQdXNoIEludGVncmF0aW9uCgpVc2VyLT5TUDogcmVzb3VyY2UgcmVxdWVzdApub3RlIHJpZ2h0IG9mIFNQOiBTUCBpc3N1ZXMAWAVhdXRobgAlCVNQLT5Vc2VyOiByZWRpcmVjdCB0bwB3CgBiBwCBCAk6ADoJZW50aWMAgQkFAHEJAIEuCQBLCGRpc2NvdmVyeSBpbnRlcmZhY2UAgRAPAHUGVXNlciBjaG9vc2VzIElkUABkEnByZWZlcnJlZAAaBQCBVQ4iAIImCSI6AIIwCwCBbAdMb0EtMQCBZg8AgRgRAIFwDABdDgCBdwk6AD8LAIFmFgCCQQh1c2VybmFtZS9wYXNzd29yZCBsb2dpbgCBYCQAgk4LZXMAcAwAQgl0b2tlbgCDVQ8AgRkFSWQAg10JAIFlDnNwb25zZQCBFQwAg0MnAIFZFwBJBwCCXyV2YWxpZGF0AHwYAIMiJm5pdGlhbGl6ZXMAhggFAIJIBQCEYAxEdW8gU2VydmljZToAhioFcHJlLQCFWA4AGAsAhUANAB4QAIIiCgCFOw4AbwkAhSUkc2VsZWN0AIEnBlB1c2gAhjISAIckByBmb3IAHAoAgTYcAIEzGwCIFwUAgXYJcHVzaACIAQkADwwtPk1vYmlsZQCGawcAIwVub3RpZgCHPgcAhkQQACMLIjogADELIGFwcHJvdmVzAIg6DwBUCwCDBA9zaWduZWQAhhIFAIUFCgCCdhwAg3E1AIlPEgCDNRgAiV0MUwCIZAhTUACJRBcAhVoVAIpPBwCFVQoAZRMAik4MAIsaCQCHBgc&s=napkin

> That sounds like a pretty asynchronous process.

Duo Push is asynchronous but despite that it works surprisingly well
in practice.

> All of that was me figuring out if I could
> write a submodule for the MCB without having used Duo ever.

You certainly can :-)

Tom