Azure MFA with Shibboleth

[Sean Flannery]

> This question is a bit broad but, does anyone have any experience
> using Shibboleth IDP with Azure ADFS and Azure MFA?

 Could you be more specific what exactly the connection between those
terms should be?



Yes. Though, to be honest, I more know what I want and less how / if it can be done.  But, to add some detail:

1) most of our apps are protected by shibboleth SPs going against shibboleth IDP with LDAP as datasource. No MFA.

2) some of our apps are protected by shibboleth SPs going against cloud Azure-as-an-IDP. MFA works here and is provided by Azure.


We need to rollout MFA to the apps in group #1.

We could just roll out #2 (Azure as IDP) to all the apps and achieve MFA coverage but Azure as IDP is a lot more restrictive than shibboleth IDP. For various reasons we greatly prefer shibboleth IDP.

But most our users are doing MFA in Azure for their webmail and they use the MS Authenticator app on their watch or phone and like it.

So we would prefer to design something where we can use shibboleth as IDP (to keep IT happy) but Azure is --some how-- MFA provider (to keep users happy). That is essentially the ask: shib IDP with azure MFA.

As I think about it, I think we would less want to use ADFS which I think would be heading in the opposite  direction (Azure login deferring to shibboleth IDP) and more, if possible, setup a shibboleth IDP to use Azure as an external auth source where azure also provides MFA?

Hopefully this detail helps some and that I'm getting enough of the terminology right to explain.

Appreciate the time. Any suggestions would be appreciate.

Sean

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Peter Schober <peter.schober at univie.ac.at>
Sent: Thursday, June 28, 2018 2:01:45 PM
To: users at shibboleth.net
Subject: Re: Azure MFA with Shibboleth

* Sean Flannery <sean.flannery at jwt.com> [2018-06-28 19:45]:
> This question is a bit broad but, does anyone have any experience
> using Shibboleth IDP with Azure ADFS and Azure MFA?

Could you be more specific what exactly the connection between those
terms should be?

-peter
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180628/2703093a/attachment.html>