Custom AuthN Flow

[Albert Zaharovits]

Hello everyone,

I have installed and configured IdP 3.3 and got it tested against TestShib
with the LDAP Username and Password validation flow. All good for know,
very nice documentation btw :)

This is what I need help at:
I want to implement the following authn flow:
1) the login window presents the user with a challenge: PIN/QR code (this
could be a webview to an external server)
2) the user inputs/scans the code with a mobile app on his *personal* phone
3) the users completes the authn flow on his phone and reports to the
external server
    * meanwhile the IdP session polls the external server for authn status
(maybe the server can push the result to IdP)
4) the IdP AuthenticationContext is updated with the AuthenticationResult
*and* the Subject

Note that compared to the duo second factor implementation the Subject is
not filled by a previous authn flow it is filled together with the
AuthenticationResult by this flow, as the mobile app is registered to a
Subject on the external server.

What do you think about that?
I must admit I am stumped and I think I need  some help from the developers
on that.
Where should I dig for clues?


Thank you shibboleth community!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170125/b89df3a0/attachment.html>