Configuring authentication in IDP 3.3.2

[Cantor, Scott]

I'll say upfront, if you want in depth help on specific things, use the support.shibboleth.net system set up for members (UV is a member).

> Password verification stops at the first success, and fails only if all three
> checks fail.  Looks like I need the JAAS flow.

That's the simplest way. I'm having enough issues myself that I'm probably going to look at other ways of cascading validators but it's an out of the box solution for the time being, and I've used 2-3 back-ends for a long time, dating back to IdP v1.

> The login CGI is using a Samba "libnetapi" call to verify the Windows
> passwords, but I think I can use LDAP instead (direct bind?) on the IDP.

Or Kerberos if it's AD. The biggest problem is Oracle's broken JAAS module for Kerberos doesn't check the KDC, so it's nominally insecure if your path to the AD isn't trustable.

> First question, should I use JAAS to handle the password verification? If I can
> use LDAP for all three verifiers, would it be better to avoid JAAS?  The three
> password stores are three independent services, not redundant servers for
> the same service.  Users have different DN formats, etc.

Can't cascade LDAP checks that way currently without JAAS, that's what I'd like to try and fix at some point. A custom flow can do anything it wants of course, but that wouldn't be as easy as JAAS is.

> I obviously need the MFA flow, the X509 flow, and the Duo flow. And I need
> either the Password flow or the JAAS flow. I'm not sure yet how to stitch all
> this together, but I'll keep reading the wiki.

The X509 flow has some hooks back into that idea of a Login button to opt in to X.509 so I think that sort of thing works but I haven't deployed it, and there will always be complexity involved. It's best to leverage the MFA flow as much as possible. Instead of having Password branch off to something else, have the button signal a custom event that the MFA scripting switches off of to branch to something else.

> In order to use RemoteUser our IDP is behind an Apache httpd reverse
> proxy, which terminates SSL. But in order to use the X509 flow, I think I must
> eliminate httpd and have Jetty itself terminate SSL.

Not necessarily, you can pass the certificate across and get it picked up by Java, or you could rework the X.509 idea into mapping the cert into a user and using the RemoteUser flow.

-- Scott