Feedback on Multi-Context Broker Community Contribution

[Paul Hethmon]

It could definitely do this. The configuration maps the requested authentication context value from the SP to a method that processes it. You can think of it as setting up N login handlers in Shib's handler.xml each mapped to a different authentication context. The difference being the MCB introduces the concept of each context/method having a strength value and can step up if necessary. RemoteUser just has that limitation of not supporting forced authentication.

Paul

From: <Wessel>, Keith <kwessel at illinois.edu<mailto:kwessel at illinois.edu>>
Reply-To: Shibboleth Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Monday, October 21, 2013 4:44 PM
To: Shibboleth Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: RE: Feedback on Multi-Context Broker Community Contribution

We’d love if we could somehow use your MCB work to use a Remoteuser login handler for basic or unspecified authn requests but use something from Duo for MFA requests. I’m not sure, after reading your docs, that this is doable, though. Thoughts or comments? Am I nuts here? :)

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131022/15a9f955/attachment.html