TOTP Google Authenticator for IdP?

[Tom Scavo]

On Fri, Oct 31, 2014 at 5:47 AM, Lukas Hämmerle
<lukas.haemmerle at switch.ch> wrote:
>
> Is anybody aware of a method/login handler that would allow a Shibboleth
> Identity Provider to support time-based one-time passwords (TOTP)

There are a couple of contributions in the wiki but I'm not sure if
any of those meet your needs.

> e.g.
> by using the Google Authenticator? Is somebody already using it?

I assume you're talking about the PAM interface in the Google
Authenticator distro, not the client-side native app. I've never used
the PAM module but everything I've read and heard suggests that is NOT
production-ready.

Btw, avoid the Google Authenticator native app altogether. Folks have
been burned by using that (lost keys). There are much better
alternatives available.

> I have found some posts from some US universities [1] that wanted to
> have a look at TOTP but other than that, nothing concrete seems to be
> available for that topic.

I haven't reviewed the thread you referred to but here's what I know.
If you're looking for a free (non-commercial) server-side
implementation of OATH TOTP, take a look at Chris Hyzer's open-source
implementation. which I believe is in production at the University of
Pennsylvania. Go to the MFA Cohortium home page
(https://spaces.internet2.edu/x/4AwwAg), search for "Penn" on that
page, and you will find links to Chris' presentation materials.

Chris' implementation leads to an on-premise solution. Depending on
whom you talk to, that's a good thing. In contrast, many US higher ed
institutions are using (or piloting) the Duo Security cloud-based
solution. It's a commercial product (which may not meet your needs
given your geographic location) but I use it and recommend it.

Duo supplies a Shibboleth login handler for its product. (I consulted
with Duo while the login handler was being built.) There's a link to
that in the contributions section of the wiki. I don't know what
campuses are using that, however.

Btw, the client-side of the Duo solution is called Duo Mobile, which
is free. It is infinitely better than its Google Authenticator
counterpart. I use Duo Mobile for everything (Gmail, Dropbox, and Duo
itself).

> [1]
> http://www.educause.edu/discuss/discussion-groups-related-educause-programs/identity-and-access-management-discussion-group/use-2-factor-authenticati

Hope this helps,

Tom