Feedback on Multi-Context Broker Community Contribution

[Wessel, Keith]

Excellent! I'm assuming though, that for the MFA route, we'd have to either use JAAS (as that's what's built into the Duo-contributed login handler) or make our own version of the Duo login handler to get the 1st factor from RemoteUser. We can't string together two login handlers, in other words, using RemoteUser then taking the principal and passing it to the Duo login handler.

Is that right?

Keith


From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Paul Hethmon
Sent: Tuesday, October 22, 2013 7:26 AM
To: Shib Users
Subject: Re: Feedback on Multi-Context Broker Community Contribution

It could definitely do this. The configuration maps the requested authentication context value from the SP to a method that processes it. You can think of it as setting up N login handlers in Shib's handler.xml each mapped to a different authentication context. The difference being the MCB introduces the concept of each context/method having a strength value and can step up if necessary. RemoteUser just has that limitation of not supporting forced authentication.

Paul

From: <Wessel>, Keith <kwessel at illinois.edu<mailto:kwessel at illinois.edu>>
Reply-To: Shibboleth Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Date: Monday, October 21, 2013 4:44 PM
To: Shibboleth Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: RE: Feedback on Multi-Context Broker Community Contribution

We'd love if we could somehow use your MCB work to use a Remoteuser login handler for basic or unspecified authn requests but use something from Duo for MFA requests. I'm not sure, after reading your docs, that this is doable, though. Thoughts or comments? Am I nuts here? :)


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20131022/ec47d27a/attachment-0001.html