MFA - TOTP plugin

[Joseph Fischetti]

Scott
I completely understand the point that there isn't any token management
worked into the solution.  The main reason that I (personally) feel it's out
of scope is because the IdP is an identity provider, not an identity
manager.  It's up to the deployer to handle password management outside of
the IdP, so token/seed management should be the same way.

> Yes, but Duo has the entire enrollment component, token management,
revocation, and of course the form factors that people actually like (they
hate codes). So that's the "cost" inherent in any other solution, it's not
free.

There's pros and cons.  I never said this plugin was free, I said there was
0 cost to running it after it was set up.  Sure, there's development time on
the front end for token enrollment, and you'll need a helpdesk... but Duo is
some fixed cost per user per period (it's been a while since I had a pricing
talk with them).  This is the same cost for 5 users to 40,000 users.   

For what it's worth... I already have a token enrollment tool built that
would be straightforward enough to implement (with QR codes and verification
etc), but it would just require the IdP's ability to write back to the
directory (which I don't like the idea of).  

As with anything else, it also doesn't need to be an either-or.  

Thanks for the response


Joe Fischetti
Linux System Administrator
Marist College

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Monday, December 9, 2019 11:32 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: MFA - TOTP plugin

[EXTERNAL EMAIL]

On 12/9/19, 7:43 AM, "users on behalf of Joseph Fischetti"
<users-bounces at shibboleth.net on behalf of Joseph.Fischetti at marist.edu>
wrote:

> There doesn't seem to be much discussion on here about such support; 
> The go-to really appears to be Duo.  The main differences between what 
> I've implemented and Duo is that here there's no reliance on an outside
connection for validating the OTP.  Once you get passed the setup, there's
also 0 cost.

Yes, but Duo has the entire enrollment component, token management,
revocation, and of course the form factors that people actually like (they
hate codes). So that's the "cost" inherent in any other solution, it's not
free.

> OTP seeds are stored encrypted in the attribute store of your choosing 
> (accessible via the attribute resolver).  Flow control is done via the MFA
flow.  The IdP does nothing to maintain the seed storage. i.e. token
enrollment is done out
> of band.   There's more in the readme included in the repo. [1]

That's kind of the problem, it's not a complete solution, but using the
resolver to access the data is a strong play for us as a project and I'm
more than happy to evaluate the code for inclusion in a release (possibly
the next, just depends how much work it might be, we're close to beta).

I don't foresee significant adoption without those other pieces, but I'm
also prepared to be wrong, and it isn't likely much for us to maintain
because of that omission. It's a start, at least.

It appears to be Apache-licensed, so technically that frees it up for
possible inclusion, but it's only polite to ask.

-- Scott


--
For Consortium Member technical support, see
https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 5597 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20191209/1f2c2664/attachment.p7s>