Duo Alternatives?

[Greg Haverkamp]

On Wed, Nov 15, 2017 at 8:48 AM, Manuel Haim <haim at hrz.uni-marburg.de>
wrote:

> Hi Josh,
>
> there seems to be a Shibboleth plugin for use with LinOTP:
> https://github.com/cyber-simon/idp-auth-linotp


We're using LinOTP with Shibboleth with a heavily modified (essentially
unrecognizable) fork of this module.  We've been doing so for around 6
months now.

If distractions would quit getting in the way, I'd have finished at least
adding U2F support and "KeyIdentity" Push Token support to the Shibboleth
module.  (I'm still hoping to have a first pass of that done this week, at
least for U2F; the push tokens are a bit trickier.)

I haven't checked InCommon Duo pricing lately; we didn't qualify, and the
market price for Duo was considerably higher.  That, and we needed MFA for
Active Directory desktops, and Duo's solution was ill-suited to our
requirements.  However, in general, Duo's solution is quite a bit slicker
than LinOTP's.  In particular, the LinOTP enrollment apps are sufficiently
poor that we decided from the start that we had to do our own.  And, of
course, the push tokens for LinOTP aren't part of the open source distro.
(Technically, the token code itself is there.  What's not there are the
push notification servers.)

I can't currently distribute my currently module, but I don't foresee it
being an issue.  I just haven't bothered doing it until I get the last two
pieces in.


> However, we currently plan to implement Shibboleth multi-factor
> authentication along with the LinOTP-fork "privacyIDEA" and Yubikey tokens.
>
> Up to now, we already have an privacyIDEA-LDAP-Proxy running for some
> secured applications. Instead of the password alone, the user has to
> enter password + Yubikey token into the password field. The LDAP-Proxy
> then forwards the password check to our regular LDAP servers, while the
> token check is forwarded to the privacyIDEA server.
>

We have something similar for the LinOTP server.  (Not theirs, which is
based on an OpenLDAP Perl backend and seemed to have concurrency issues in
our testing.  We'd had one for our prior solution that we ported over.)

Greg


>
> Kind regards,
> Manuel
>
> Philipps University Marburg, Germany
>
>
>
> Am 15.11.2017 um 17:09 schrieb O'Dowd, Josh:
> > I am doing due diligence for a likely Duo purchase, which I have demo’d
> > on campus using the outstanding Shibboleth native support.  I am curious
> > if there are any known legitimate alternatives to Duo as a 2^nd factor
> > solution WITHOUT sacrificing Shibboleth IdP front-channel password
> > authentication as the 1^st factor.
> >
> >
> >
> > We are not considering a custom built solution at this time.
> >
> >
> >
> > I truly appreciate any feedback from the Shibboleth community.
> >
> >
> >
> > Thank You!
> >
> >
> >
> > Josh O’Dowd
> >
> > Software Systems Engineer / Identity Access Management
> >
> > University of Montana
> >
> >
> >
> >
> >
>
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171115/e950269d/attachment.html>