Duo Alternatives?

[Rob Gorrell]

SafeNet Authentication Service touted a Shibboleth Agent back when we were
looking... IIRC, it was less than impressive looking.

-Rob

On Wed, Nov 15, 2017 at 12:04 PM, Greg Haverkamp <gahaverkamp at lbl.gov>
wrote:

> On Wed, Nov 15, 2017 at 8:48 AM, Manuel Haim <haim at hrz.uni-marburg.de>
> wrote:
>
>> Hi Josh,
>>
>> there seems to be a Shibboleth plugin for use with LinOTP:
>> https://github.com/cyber-simon/idp-auth-linotp
>
>
> We're using LinOTP with Shibboleth with a heavily modified (essentially
> unrecognizable) fork of this module.  We've been doing so for around 6
> months now.
>
> If distractions would quit getting in the way, I'd have finished at least
> adding U2F support and "KeyIdentity" Push Token support to the Shibboleth
> module.  (I'm still hoping to have a first pass of that done this week, at
> least for U2F; the push tokens are a bit trickier.)
>
> I haven't checked InCommon Duo pricing lately; we didn't qualify, and the
> market price for Duo was considerably higher.  That, and we needed MFA for
> Active Directory desktops, and Duo's solution was ill-suited to our
> requirements.  However, in general, Duo's solution is quite a bit slicker
> than LinOTP's.  In particular, the LinOTP enrollment apps are sufficiently
> poor that we decided from the start that we had to do our own.  And, of
> course, the push tokens for LinOTP aren't part of the open source distro.
> (Technically, the token code itself is there.  What's not there are the
> push notification servers.)
>
> I can't currently distribute my currently module, but I don't foresee it
> being an issue.  I just haven't bothered doing it until I get the last two
> pieces in.
>
>
>> However, we currently plan to implement Shibboleth multi-factor
>> authentication along with the LinOTP-fork "privacyIDEA" and Yubikey
>> tokens.
>>
>> Up to now, we already have an privacyIDEA-LDAP-Proxy running for some
>> secured applications. Instead of the password alone, the user has to
>> enter password + Yubikey token into the password field. The LDAP-Proxy
>> then forwards the password check to our regular LDAP servers, while the
>> token check is forwarded to the privacyIDEA server.
>>
>
> We have something similar for the LinOTP server.  (Not theirs, which is
> based on an OpenLDAP Perl backend and seemed to have concurrency issues in
> our testing.  We'd had one for our prior solution that we ported over.)
>
> Greg
>
>
>>
>> Kind regards,
>> Manuel
>>
>> Philipps University Marburg, Germany
>>
>>
>>
>> Am 15.11.2017 um 17:09 schrieb O'Dowd, Josh:
>> > I am doing due diligence for a likely Duo purchase, which I have demo’d
>> > on campus using the outstanding Shibboleth native support.  I am curious
>> > if there are any known legitimate alternatives to Duo as a 2^nd factor
>> > solution WITHOUT sacrificing Shibboleth IdP front-channel password
>> > authentication as the 1^st factor.
>> >
>> >
>> >
>> > We are not considering a custom built solution at this time.
>> >
>> >
>> >
>> > I truly appreciate any feedback from the Shibboleth community.
>> >
>> >
>> >
>> > Thank You!
>> >
>> >
>> >
>> > Josh O’Dowd
>> >
>> > Software Systems Engineer / Identity Access Management
>> >
>> > University of Montana
>> >
>> >
>> >
>> >
>> >
>>
>> --
>> For Consortium Member technical support, see
>> https://wiki.shibboleth.net/confluence/x/coFAAg
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Robert W. Gorrell
IT Manager, Identity and Access Management
University of NC at Greensboro
336-334-5954
PGP Key ID B36DB0CA
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171115/e37ea62f/attachment.html>