Using Password authn flow for 1st and 2nd factors

[Ian Bobbitt]

Hi,

I'm wanting to use (copies of) the Password authn flow for the 1st factor (Kerberos backed) and 2nd factor (JAAS backed).

The 2nd would use a fork of jradius-client (https://github.com/detiber/jradius-client) talking to a RADIUS server backed
to LinOTP (http://linotp.org/). JAAS -> jradius-client -> RADIUS server -> LinOTP isn't a hard requirement for the
authentication path. If I can cut out some of the steps before LinOTP that would be great too.

Either authentication flow works fine in isolation, switching between the krb5-authn-config.xml and
jaas-authn-config.xml imports in password-authn-config.xml. My stumbling block is getting a second copy of the flow
working, and figuring out how to keep the username from the first instance through to the end instead of overwriting it
in the second.

Does someone already have something like this working that they can share with me, or help walk me through what I need
to do to make it happen? I think this would be generally useful for more than just me. A lot of OTP systems use RADIUS.

Later, I would also like to be able to force always requiring the 2nd factor for users in an LDAP group, but one step at
a time.

--
Ian

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3639 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20170112/0ad23917/attachment-0001.p7s>