Configuring authentication in IDP 3.3.2

[Losen, Stephen C. (scl)]

Hi folks,

We are running IDP 3.3.2.  It is configured to use RemoteUser but we want to retire our current SSO system in favor of Shibboleth, and configure the IDP to work like our SSO login CGI (within reason).

The SSO CGI presents a form with a button that says "Login with Certificate" and also has a username field, password field, and "Login" submit button beneath.

If the user clicks "login with Certificate" then she gets redirected to a URL that requires a client SSL cert.  This URL invokes the SSO CGI, which obtains the client cert info from Apache httpd in CGI variables.

If the user enters username, password, and clicks the "Login" button, then the CGI verifies the password using three password stores: an LDAP server, an "academic" Windows DC, and a "health system" (medical center) Windows DC.
Password verification stops at the first success, and fails only if all three checks fail.  Looks like I need the JAAS flow.

The login CGI is using a Samba "libnetapi" call to verify the Windows passwords, but I think I can use LDAP instead (direct bind?) on the IDP.

And we are using Duo for MFA second factor.

First question, should I use JAAS to handle the password verification? If I can use LDAP for all three verifiers, would it be better to avoid JAAS?  The three password stores are three independent services, not redundant servers for the same service.  Users have different DN formats, etc.

I obviously need the MFA flow, the X509 flow, and the Duo flow. And I need either the Password flow or the JAAS flow. I'm not sure yet how to stitch all this together, but I'll keep reading the wiki.

In order to use RemoteUser our IDP is behind an Apache httpd reverse proxy, which terminates SSL. But in order to use the X509 flow, I think I must eliminate httpd and have Jetty itself terminate SSL.

The Duo flow will get called conditionally based on user attributes (and possibly SP entityID) but I see that the MFA flow is very configurable in this regard.

Is anyone else running a setup similar to this?  Any pointers or suggestions for configuring this in the IDP?

Thanks,


Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640