RSA Adaptive Authentication

[Bryan Wooten]

Bryan Wooten
Email: bryan.wooten at utah.edu

> Their answer to the (IMHO bogus) MFA solutions now flooding the market is the Adaptive thing.

This statement intrigues me. Bogus MFA Solutions flooding the market, are you refering to 1. phone apps in general / 2. Google stuff / 3. other?

If it is phones apps in general that you do not consider to be real MFA can you state why you believe that from a technical perspective?

Thanks,

Bryan

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, July 06, 2015 9:47 AM
To: Shib Users
Subject: Re: RSA Adaptive Authentication

On 7/6/15, 11:23 AM, "users on behalf of Rob Gorrell" <users-bounces at shibboleth.net on behalf of rwgorrel at uncg.edu> wrote:

>I was wondering if anyone out there is doing/has done any work towards integrating RSA's Adaptive Authentication solution (their answer to MFA... risk based authentication w/step up) to a shibb IdP for primary auth?

Well, I would say that RSA's answer to MFA is SecurID, and it works great but is outrageously expensive (the tokens aren't but the license is). Their answer to the (IMHO bogus) MFA solutions now flooding the market is the Adaptive thing.

Most of the risk-based stuff is really about forcing authentication to a proprietary platform instead of supporting standards. As such, they don't tend to offer APIs you can actually implement against, they force you to offload the login to that system. So from a Shibboleth PoV, you're looking at an agent + RemoteUser type thing. I wouldn't swear they don't have an API, but I would bet they will make it hard to find/use.

They also increasingly of course bundle their SAML support and proxy portal solutions into those RBA platforms (RSA's is called VIP I think) so they're basically in competition rather than complementary.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net