Multi-factor authentication with two IdPs

[Cantor, Scott]

On 8/27/15, 4:29 PM, "users on behalf of Dan Ciarniello" <users-bounces at shibboleth.net on behalf of DCiarniello at central1.com> wrote:

>The current setup is, I believe, fairly standard with a service provider behind a reverse proxy (an F5) with an ADFS system providing SSO services.
>
> 
>As I understand it, the basic workflow is:
> 
>1. F5 redirects user to ADFS for login
>2. ADFS returns SAML response to the F5 with various “claims” including a user id
>3. F5 then forwards the SAML response to the service provider

Unless the F5 is the SP itself, I'm not sure it's relevant to the conversation. Regardless...

> 
>What I would like to do is insert a step after step 2 whereby after initial login, the F5 forwards the SAML Response to Shibboleth for further authentication using a custom extension. 
>The custom extension requires the user id from the initial login to perform the second authentication step. 

That's not just a simple custom extension, that's an *SP*. Shibboleth IdPs don't include an SP or support for natively proxying SAML authentication. You would have to install a SAML SP as an authentication mechanism for the IdP to site behind along with adding additional custom code to the attribute resolver to do all that.

Most other major IdP implementations include that sort of thing natively.

> 
>I’m wondering if this is possible?

Not easily.

-- Scott