MFA vs. Password and Extended Flow in IDP

[Cantor, Scott]

On 6/27/18, 9:48 AM, "users on behalf of Losen, Stephen C. (scl)" <users-bounces at shibboleth.net on behalf of scl at virginia.edu> wrote:

> I am building a new configuration where the IDP authenticates directly. I want to eliminate Apache httpd and terminate > SSL on the F5.  The F5 will reverse proxy to jetty/IDP (non-SSL port 8080).  When appropriate, the F5 will pass 
> information about the client cert in HTTP headers.  And yes, I will be careful to prevent HTTP header forgery on the F5,
> and jetty/IDP will only allow requests from the F5.  So that is why I am using authn/RemoteUser for client certs.  
> Jetty/IDP gets the client cert info from HTTP headers.

Just FYI, this doesn't go hand in hand. Java consumes the cert via an attribute with a special name in the servlet spec, so to use the X509 flows, all you really have to do is populate that attribute from the header containing the certificate. I believe there's donated code for that via a filter that we offered to include with 3.4.

Not that that argues either way, just saying it doesn't imply Jetty's doing the TLS (and yes, client authn in Jetty is horrific).

-- Scott