Google 2sv instead of Duo for MFA in Shibboleth IdP?

[Rich Graves]

(duo-users removed because I'm not subscribed, but y'all feel free to
forward my reply there.)

Yes, stolaf.edu took an AFAIK novel approach to this a couple months ago.
It works pretty well for stolaf.edu because it is "a Google campus."

Authentication to the Shibboleth IdP uses a RemoteUser URL protected by a
reverse proxy running Google OAuth2 (
https://wiki.shibboleth.net/confluence/display/IDP30/RemoteUserAuthnConfiguration).
So people hit a Shibbolized SP, are redirected to login.stolaf.edu, which
redirects them again to accounts.google.com, which asks for Google password
and 2-Step, then attribute release and final redirect to the SP are handled
by Shibboleth.

It is *possible* to use "Google Authenticator" (or any other OATH-TOTP or
OATH-HOTP app) with Shibboleth, but your users will hate you. Stanford
tried this in 2013 but it was not long before they switched to Duo. If you
want a full-featured experience with self-service, phone and SMS callback,
the Google Prompt "push" app, and multiple devices, you need to buy Duo (or
competing service) -or- put your IdP behind Google (or Microsoft) OAuth2,
as St. Olaf has done.

Carleton.edu (I wear two hats as half-time ISO for both) is going the
"traditional" route with Duo. It has been very interesting launching
simultaneous 2-factor campaigns at both campuses with these different
technologies (http://blogs.carleton.edu/rgraves). Duo gives me much better
logs, helpdesk access, whitelisting possibilities, and obviously has the
edge for non-web-based applications, but I have to say that new users find
Google 2-Step enrollment more intuitive.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161020/9bf1b873/attachment-0001.html>