Feedback on Multi-Context Broker Community Contribution

[Tom Scavo]

On Tue, Oct 22, 2013 at 8:23 AM, Paul Hethmon
<paul.hethmon at clareitysecurity.com> wrote:
> On 10/21/13 5:57 PM, "Tom Scavo" <trscavo at gmail.com> wrote:
>>
>>That's how
>>the current Duo Login Handler works---it authenticates the user with a
>>password and then passes the resulting identifier to the Duo Service.
>
> So this step is fuzzy to me. I authenticate the user with a password using
> some sort of method (JAAS, custom, etc). Does my server now contact the
> Duo server directly?

Yes, that's how the current Duo Login Handler works.

> If so, does it then poll the Duo server for the
> response to the out of band authentication?

In the case of Duo Mobile OTP, no, it's ordinary REST-based
request/response, but in the case of Duo Push, yes, the server just
sits there and waits for success (or failure) to be reported by the
Duo Service. (Before you jump to conclusion and say this can't
possibly work well in practice, let me assure you it does. We use it
here every day.)

>>I want to bypass that password authentication step by including an
>>identifier for the user right in the AuthnRequest. Will the MCB handle
>>that use case?
>
> If you bypass that step, aren't you throwing away a factor?

No, that's what step-up authentication is. The user is already known,
previously authenticated by some other means (say, username/password).
Now the SP decides it needs to up the ante and issues an AuthnRequest
to an IdP that is integrated with Duo. In the AuthnRequest is the
user's identifier, say, the user's email address (but it could be ePPN
or whatever, as long as it's the same identifier used to enroll the
user's mobile device in the first place). That's all the IdP needs to
authenticate the user with the Duo Service.

Note: Use Duo Mobile OTP for step-up authentication. Do not use Duo
Push since this would allow an attacker to perform a DoS attack on the
user’s mobile device.

> Or are you rolling that factor into the Duo stuff?

No. How the SP knows the identity of the user is unspecified.

Tom