Feedback on Multi-Context Broker Community Contribution

[Paul Hethmon]

On 10/21/13 6:08 PM, "Tom Scavo" <trscavo at gmail.com> wrote:

>Here's a sequence diagram when using a Duo Mobile OTP:
>
>http://www.websequencediagrams.com/cgi-bin/cdraw?lz=dGl0bGUgRGlzdHJpYnV0ZW
>QgMkZBIElkUCBQcm94eSAtIER1byBNb2JpbGUgSW50ZWdyYXRpb24KClVzZXItPlNQOiByZXNv
>dXJjZSByZXF1ZXN0Cm5vdGUgcmlnaHQgb2YgU1A6IFNQIGlzc3VlcwBaBWF1dGhuACUJU1AtPl
>VzZXI6IHJlZGlyZWN0IHRvAHkKAGIHAIEKCToAOgllbnRpYwCBCQUAcQkAgTAJAEsIZGlzY292
>ZXJ5IGludGVyZmFjZQCBEA8AdQZVc2VyIGNob29zZXMgSWRQAGQScHJlZmVycmVkABoFAIFVDi
>IAgigJIjoAgjILAIFsB0xvQS0xAIFmDwCBGBEAgXAMAF0OAIF3CToAPwsAgWYWAIJBCHVzZXJu
>YW1lL3Bhc3N3b3JkIGxvZ2luAIFgJACCTgtlcwBwDABCCXRva2VuAINVDwCBGQVJZACDXQkAgW
>UOc3BvbnNlAIEVDACDQycAgVkXAEkHAIJfJXZhbGlkYXQAfBgAgyImbml0aWFsaXplcwCGCgUA
>gkgFAIRgDER1byBTZXJ2aWNlOgCGLAVwcmUtAIVYDgAYCwCFQA0AHhAAgiIKAIU7DgBvCQCFJS
>RlbnRlcnMgT1QAhTUTb25lLXRpbWUAg0wFY29kAIIhJwCHVQcAUAUAgk0IaW8AgWgeAIFYKgCC
>YTUAiD8SAIIlGACITQxTAIdUCFNQAIg0FwCEShUAiT8HAIRFCgBlEwCJPgwAigoJAIV2Bw&s=n
>apkin
>
>Here's a sequence diagram when using Duo Push:
>
>http://www.websequencediagrams.com/cgi-bin/cdraw?lz=dGl0bGUgRGlzdHJpYnV0ZW
>QgMkZBIElkUCBQcm94eSAtIER1byBQdXNoIEludGVncmF0aW9uCgpVc2VyLT5TUDogcmVzb3Vy
>Y2UgcmVxdWVzdApub3RlIHJpZ2h0IG9mIFNQOiBTUCBpc3N1ZXMAWAVhdXRobgAlCVNQLT5Vc2
>VyOiByZWRpcmVjdCB0bwB3CgBiBwCBCAk6ADoJZW50aWMAgQkFAHEJAIEuCQBLCGRpc2NvdmVy
>eSBpbnRlcmZhY2UAgRAPAHUGVXNlciBjaG9vc2VzIElkUABkEnByZWZlcnJlZAAaBQCBVQ4iAI
>ImCSI6AIIwCwCBbAdMb0EtMQCBZg8AgRgRAIFwDABdDgCBdwk6AD8LAIFmFgCCQQh1c2VybmFt
>ZS9wYXNzd29yZCBsb2dpbgCBYCQAgk4LZXMAcAwAQgl0b2tlbgCDVQ8AgRkFSWQAg10JAIFlDn
>Nwb25zZQCBFQwAg0MnAIFZFwBJBwCCXyV2YWxpZGF0AHwYAIMiJm5pdGlhbGl6ZXMAhggFAIJI
>BQCEYAxEdW8gU2VydmljZToAhioFcHJlLQCFWA4AGAsAhUANAB4QAIIiCgCFOw4AbwkAhSUkc2
>VsZWN0AIEnBlB1c2gAhjISAIckByBmb3IAHAoAgTYcAIEzGwCIFwUAgXYJcHVzaACIAQkADwwt
>Pk1vYmlsZQCGawcAIwVub3RpZgCHPgcAhkQQACMLIjogADELIGFwcHJvdmVzAIg6DwBUCwCDBA
>9zaWduZWQAhhIFAIUFCgCCdhwAg3E1AIlPEgCDNRgAiV0MUwCIZAhTUACJRBcAhVoVAIpPBwCF
>VQoAZRMAik4MAIsaCQCHBgc&s=napkin

Both of these appear to separate out the two factors. The IdP is doing one
factor (user/password) while the "IdP Proxy" is doing the Duo factor. So
are you required to have two servers to implement this?

Paul