2 factor authentication

[Cantor, Scott]

On 1/13/15, 11:34 PM, "Vignesh, Vanna G." <vignesh at musc.edu> wrote:



>I am new to 2 FA. We use shibboleth for SSO and we'd like to implement 
>Microsoft’s 2fa (phone prompt) along with it. The following are the 
>requirements.

Then you would have to build a login handler (or a V3 flow, more 
advisably) to implement that mechanism.

>a) If the user's request to a SP comes within the company's network, it 
>should not prompt for 2fa. Only user name and password auth should be 
>prompted.
>b) All users (outside network) must go through 2FA even if SP is not 
>requesting for 2FA.
>c) The authentication mechanisms behind 2FA  and username-pwd are 
>different.
> 
>What are the options I have? Thanks!

Writing code. That's the only option.

As a matter of terminology, let me point out that Microsoft's solution is 
not 2FA, nor is Duo, nor is any OATH token, etc. Those are single factors.

RSA SecurID is the only 2FA solution I specifically know of. I'm sure 
others exist, but single factor tokens that have to be combined with other 
factors are not 2FA in and of themselves.

-- Scott