Using an external URL for Multi-factor auth

[Cantor, Scott]

> I have a system that uses a simple GET request to validate a
> multifactor token.  Validation success is signaled by returning an
> HTTP status code.  How can I use this with Shibboleth IdP (3.2.1)?

Writing a custom webflow, or building a servlet or JSP to issue the GET and using the External method to redirect to it.

> I've looked at the ExternalAuthnConfiguration and I am not sure if
> this is what I need to use?  Is the shibboleth idea of "external" the
> same thing as what I'm talking about here?

No, External means "not using a webflow". Issuing a GET like this is definitionally something the IdP has to do, so you have to write the code to do it, be it in a webflow or as a servlet/JSP called by the External flow.

> The user's browser
> shouldn't be forwarded to the external system; it would be shibboleth
> acting as the client to the validation service on the backend.

Yes, I follow you.

> If not, is there any boilerplate code that does something like this?

There's the IdP code itself and what little I've gotten documented in the wiki, that's it. There are servlets included that handle RemoteUser and X509 that are usable as examples of building an external login mechanism. They're referenced by web.xml so the classes can be identified from there.

> I'm mainly a sysadmin, but I can understand code at a basic level.

This is more than basic code. Building code to do authentication isn't something you can be mostly sure on, you have to be a programmer or you're risking a major breach IMHO. You're also talking about network calls here. That's easy to screw up and hang the IdP if you don't follow good practices for connection handling, timeouts, etc. Using a bad HTTP library can be fatal. There are also security implications to making that call.

-- Scott