2 Factor Iframe Similar To Duo

[Bryan Wooten]

Ok, you aren't a member of Incommon, you can still negotiate a price with Duo outside of that. Besides there are many other MFA vendors out there.

Aside from that, rolling your own MFA solution sounds like a really bad idea. You will be rapidly stuck with technical debt.

There is a reason not to write your own sort algorithm or crypto.

But you are on the right path, MFA is the stepping stone to password free authentication.

Bryan Wooten
Tel: (801)585-9323
Email: bryan.wooten at utah.edu





-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Jon Byers
Sent: Friday, August 5, 2016 12:05 PM
To: Shib Users <users at shibboleth.net>
Subject: [Ext] RE: 2 Factor Iframe Similar To Duo

Thanks.  All helpful information.  Didn't know there was a push to move away from SMS as a method of 2-factor.  From a cost perspective it seems like the less expensive way over Duo or other providers.  We aren't a member of InCommon so we don't get the Duo discount.  I can SMS 2-factor a user for under $1 a year and Duo wants that a month.

I'll checkout SimpleSAMLphp, but we've pretty much fine tunes Shibboleth so I'd hate to start over now.

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, August 4, 2016 9:03 PM
To: users at shibboleth.net
Subject: Re: 2 Factor Iframe Similar To Duo

On 8/4/16 11:28 PM, Jon Byers wrote:
> I'm trying to accomplish the following.  I've read a lot of how the 
> MFA features of 3.3 will do a lot of what people have been looking to 
> do, but trying to get this out sooner than later.

You can always write a flow that implements all the business logic you need, but it will be a steep learning curve and any use of external components (PHP) creates a large opportunity to open security holes.

> 2. Load my own iframe php page that receives attributes from the IdP 
> via get or post, or however.

If you want to build something like that, you would use the External login flow to get out to a JSP page or servlet.

But if you do it in PHP, you'd be moving outside the sphere of the Java session so you become responsible for the security of the interaction, and that introduces a lot of complexity. You'd have to drop a cookie in a servlet and then be able to read it back in the PHP and somehow use that to tie it all together through some association somewhere.

If you want PHP, you should really just use simpleSAML.php and stay with what you're comfortable with.

> I'm hoping that
> idp.authn.LDAP.returnAttributes is what can send these attributes?

If you want to pull back data during an LDAP check and use it later during another login flow, yes, that would work. There are simpler ways in 3.3 that aren't limited to LDAP, but for LDAP specifically it would work.

> I would use the iframe to handle 2 factor requirements based on 
> attributes from the IdP.  Hopefully this makes sense.  I haven't seen 
> any mention of SMS 2 factor setups.  I'm using Plivo as my SMS gateway.

The 3.3 changes allow any single factor to implemented in a simple, self-contained flow and then combined with other factors arbitrarily. An SMS fow is certainly possible but given the general move to deprecate SMS underway, it wasn't high on the priority list, and I had it behind U2F and OATH after doing the Duo flow.

> I don't do Java, but can learn...

Well, that's a big ask to go from no Java to trying to extend a Spring WebFlow application.

-- Scott
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net