2 Factor Iframe Similar To Duo

[Cantor, Scott]

On 8/4/16 11:28 PM, Jon Byers wrote:
> I’m trying to accomplish the following.  I’ve read a lot of how the MFA
> features of 3.3 will do a lot of what people have been looking to do,
> but trying to get this out sooner than later.

You can always write a flow that implements all the business logic you
need, but it will be a steep learning curve and any use of external
components (PHP) creates a large opportunity to open security holes.

> 2. Load my own iframe php page that receives attributes from the
> IdP via get or post, or however.

If you want to build something like that, you would use the External
login flow to get out to a JSP page or servlet.

But if you do it in PHP, you'd be moving outside the sphere of the Java
session so you become responsible for the security of the interaction,
and that introduces a lot of complexity. You'd have to drop a cookie in
a servlet and then be able to read it back in the PHP and somehow use
that to tie it all together through some association somewhere.

If you want PHP, you should really just use simpleSAML.php and stay with
what you're comfortable with.

> I’m hoping that
> idp.authn.LDAP.returnAttributes is what can send these attributes?

If you want to pull back data during an LDAP check and use it later
during another login flow, yes, that would work. There are simpler ways
in 3.3 that aren't limited to LDAP, but for LDAP specifically it would work.

> I would use the iframe to handle 2 factor requirements based on
> attributes from the IdP.  Hopefully this makes sense.  I haven’t seen
> any mention of SMS 2 factor setups.  I’m using Plivo as my SMS gateway. 

The 3.3 changes allow any single factor to implemented in a simple,
self-contained flow and then combined with other factors arbitrarily. An
SMS fow is certainly possible but given the general move to deprecate
SMS underway, it wasn't high on the priority list, and I had it behind
U2F and OATH after doing the Duo flow.

> I don’t do Java, but can learn…

Well, that's a big ask to go from no Java to trying to extend a Spring
WebFlow application.

-- Scott