2nd factor IdP AuthN conditional on user attribute

[Stefan Wold]

On Thu, Feb 9, 2017 at 10:11 PM Cantor, Scott <cantor.2 at osu.edu> wrote:

> > shibboleth-mfa-u2f-auth appears to hook similar to Unicon's Duo
> > plugin, rather than Duo's own competing plugin. So it might work as is
> > with 3.3, but it's more at risk. (Duo's strategy was to sneakily
> > intercept Password without actually adding to idp.authn.flows, so
> > theirs works in 3.3.)
>
> Unicon's should work, but there's some kind of issue involving the webflow
> config hooking that probably led to the need to screw with the web.xml
> file, and the approach in general has some assumptions that probably work
> but just aren't really kosher. It's mostly moot at this point since that
> functionality is already present in 3.3.
>

Yes, the shibboleth-mfa-u2f-auth actually hooks into the webflow config,
even though no modifications to web.xml is necessary for this plugin.

> If you already have shibboleth-mfa-u2f-auth working with 3.2.1 then it
> > shouldn't be too hard to figure out how to switch the flow on or off
> > based on what UChicago and others did with shib-mfa-duo-auth.
>
> Far be it from me, if one thinks it's not too hard, have at it, it will
> still work. I don't share that opinion, so I'm just not going to try and
> help people do it anymore, if I ever did.
>
>
I agree that the plugin should support the recommended way of handling MFA.


> > - Make the existing shibboleth-mfa-u2f-auth work in 3.3.
>
> To be clear, I would like to add U2F support to 3.4, but all of the
> token-based options have a problem in that we need a token registration API
> or a solution, one of the two. I don't think we have any hope of
> establishing an API, so that leaves a solution, and doing a full UI and
> back-end for managing tokens is not hard but is not trivial work.
>

I'm going to rewrite the plugin to support the new MFA framework which
seems to be the sensible thing to do here. The current plugin uses Yubico
U2Fval as a back-end, even if the plugin is easily extended to any kind of
back-end. It still requires a token management UI (app) though. I have an
experimental branch allowing registration through a webflow in the IdP
(purely for testing), but in my opinion the IdP should not have the role of
token management.

Best regards,
Stefan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170209/0c2580e1/attachment-0001.html>