Shibboleth v3 + FIDO UAF

[Cantor, Scott]

> On 19/10/16 03:48, Cantor, Scott wrote:
> > Yubico has a flow for V3 but I didn't find it to be terribly useful
> > other than as a toy and was not planning to base eventual official
> > support on it.
> 
> Oh do they? Where did you find it?
> 
> I asked a year ago whether they'd port their v2 handler to v3 [1] but
> never got a reply... :/

https://github.com/Ratler/shibboleth-mfa-u2f-auth

As I said, I didn't find it to be very practical for any real world use, but it's a fine prototype. It's also of course pre-3.3 in terms of its general approach, but that's easily addressed.

I just concluded that using their demo server wasn't really viable, and if we were going to do this for real, we need a real token registration UI along with it. I didn't have time to do that but I did have time to build out the layer we needed to start supporting flows that need users to authenticate themselves to the IdP. So we can give people the ability to login with a password to register a token and then require the token to get back in to manage their account, etc.

It's a lot of work, as I said, and I'm just not seeing the adoption. AFAIK, Chrome remains the only browser. Also, USB-A tokens are about to be useless with all the latest Macs.

-- Scott