Feedback on Multi-Context Broker Community Contribution

[Paul Hethmon]

On 10/21/13 5:57 PM, "Tom Scavo" <trscavo at gmail.com> wrote:

>I think you've answered my question (in the negative) but let me probe
>further to be sure. It seems you're assuming that one IdP is
>responsible for all factors for a particular user. My use case doesn't
>make that assumption. I'm talking about an IdP that will authenticate
>a *known* user for which it may have no session. The SP passes the
>identity of the user in a <Subject> element in the request. Based on
>that identity, the IdP now knows the user it must authenticate again.

So this would be handled at the Shib level as Scott indicated. The MCB
would produce its own Subject value based on the authentication it
processed.

>This is a perfect match for Duo, btw. When the IdP sends a authn
>request to the Duo Service, it passes an identifier for the user so
>that Duo can map that identifier to the correct Duo user. That's how
>the current Duo Login Handler works---it authenticates the user with a
>password and then passes the resulting identifier to the Duo Service.

So this step is fuzzy to me. I authenticate the user with a password using
some sort of method (JAAS, custom, etc). Does my server now contact the
Duo server directly? If so, does it then poll the Duo server for the
response to the out of band authentication?

>I want to bypass that password authentication step by including an
>identifier for the user right in the AuthnRequest. Will the MCB handle
>that use case?

If you bypass that step, aren't you throwing away a factor? Or are you
rolling that factor into the Duo stuff?

Paul