2 factor authentication

[Vignesh, Vanna G.]

I am new to 2 FA. We use shibboleth for SSO and we'd like to implement Microsoft's 2fa (phone prompt) along with it. The following are the requirements.
a) If the user's request to a SP comes within the company's network, it should not prompt for 2fa. Only user name and password auth should be prompted.
b) All users (outside network) must go through 2FA even if SP is not requesting for 2FA.
c) The authentication mechanisms behind 2FA  and username-pwd are different.

What are the options I have? Thanks!


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150113/82c2d501/attachment.html