Help with 2-factor authentication with Telesign

[Ranil De Silva]

Firstly thanks for all the advise so far it has been very helpful.

So Telesign sends an SMS to the user with the 2-factor code that they need
to enter on the screen. For that to work, the user must have been
authenticated against the LDAP first so we can retrieve their mobile phone
number from their LDAP entry. So the JAAS module will not work for me.

So creating a new flow is the approach I need to take. What I am not clear
about at the moment, is how to integrate the new flow into Shibboleth. In
particular should I be using net.shibboleth.idp.authn.* classes as the
basis of my flow. Ie should model in on the existing flows or should I
create a new flow with my own libraries and somehow inject it all into
Shibboleth or something in between.

My flow will be similar to the password-auth-flow, except after the
user/password has been validated, I need to extract the mobile# and send
the sms code, then we go to a new view, where the user has to enter this
code. Once the code has been validated we are done. If the code fails we
stay on that screen.

Thanks
Ranil


On 27 April 2015 at 03:33, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 4/26/15, 9:26 AM, "Ranil De Silva" <ranil.desilva at industrieit.com>
> wrote:
> >
> >From a custom development approach, I can see two options. The first is
> to write a JAAS module and drop it in. The second is to modify the existing
> username/password authentication to support the 2 factor authentication.
>
> You do not modify existing flows, ever. You create your own.
>
> > The JAAS module would seem to be a more independent approach to adding
> 2-factor authentication to the IDP.
>
> You can't use JAAS as easily with single factor mechanisms like Duo that
> rely on other systems to handle passwords as the second factor. JAAS works
> with self-contained mechanisms that combine a PIN with OTPs to produce both
> factors in one password field. You can buid proxy servers that take a
> combined field and split them to validate them independently in some cases.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>

-- 

This email is confidential and intended solely for the person(s) to whom it 
is addressed.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150428/050bbad8/attachment.html>