MFA vs. Password and Extended Flow in IDP

[Losen, Stephen C. (scl)]

Hi folks,

In my development environment I currently have SSL configured on Apache httpd which is a reverse proxy to jetty and the IDP (non-SSL port 8080).  So I would need to learn how to configure SSL on jetty.  I also have a F5 BigIP in front of Apache httpd. The F5 does not terminate SSL.  Much of this comes from our current production configuration, where the IDP offloads authentication to a legacy SSO system via authn/RemoteUser.

I am building a new configuration where the IDP authenticates directly. I want to eliminate Apache httpd and terminate SSL on the F5.  The F5 will reverse proxy to jetty/IDP (non-SSL port 8080).  When appropriate, the F5 will pass information about the client cert in HTTP headers.  And yes, I will be careful to prevent HTTP header forgery on the F5, and jetty/IDP will only allow requests from the F5.  So that is why I am using authn/RemoteUser for client certs.  Jetty/IDP gets the client cert info from HTTP headers.

I can't think of a mechanism other than HTTP headers to pass "environment" info from the F5 to jetty/IDP.

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Peter Schober
Sent: Wednesday, June 27, 2018 9:10 AM
To: users at shibboleth.net
Subject: Re: MFA vs. Password and Extended Flow in IDP

* Losen, Stephen C. (scl) <scl at virginia.edu> [2018-06-25 13:02]:
> For authn am using MFA with Password and Duo.  I am also using
> RemoteUser for client cert authn.

Also, why RemoteUser and not the existing X.509 support?
https://wiki.shibboleth.net/confluence/display/IDP30/X509AuthnConfiguration
-peter
-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net