Question about Shibboleth and MFA - Google Authenticator

[Greg Haverkamp]

On Fri, Feb 15, 2019 at 12:23 PM Melvin Lasky <melvin.lasky at manhattan.edu>
wrote:

> Someone asked why we want to use Google Authenticator vs Duo - Cost
> $$$$$$$$. :-)
>

Another option, if you want all sorts of other components, is LinOTP (and
at least one derivative), which is free and open source:
https://github.com/LinOTP/LinOTP.  It's what we use, both because of cost
(we do have a support contract with them, but it's still cheaper than Duo
was quoting us), and because at the time, we had to meet some  NIST
800-63-2 LoA 3 requirements, which we could accomplish with some tweaks to
LinOTP (which Duo at the time could not meet).

There's an MFA flow-compatible Shibboleth module (
https://github.com/cyber-simon/idp-auth-linotp), though it's possible that
it is not 3.4-compatible.  (At the very least, I know that my heavily
modified version works with 3.3.1 but not with 3.4.  I'm planning to
simplify greatly and rewrite in the near future.)

We don't use of the user self-service components, because they all seemed
overly busy for our users, so we rewrote everything as a highly tailored
front-end.  They've got a reasonably complete API that makes all of that
possible.

Greg
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190215/90a64af5/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: email_logo.jpg
Type: image/jpeg
Size: 7478 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20190215/90a64af5/attachment.jpg>