Question about Shibboleth and MFA - Google Authenticator

[Robert Bradley]

On 15/02/2019 17:31, Tom Scavo wrote:
> On Fri, Feb 15, 2019 at 11:22 AM Cantor, Scott <cantor.2 at osu.edu>
> wrote:
>> You have to register tokens with Duo also. The reason we haven't
>> bothered providing alternative implementations is that doing them
>> requires providing a full system for managing the tokens and the
>> registration UI, and given the almost total monopoly Duo has, it
>> hasn't seemed to be something worth doing.
> 
> Are you referring to OATH TOTP? That's the less interesting part of 
> Duo's implementation as you know. Duo pretty much invented push 
> authentication, which everyone copied, and so there are lots of 
> choices out there.
> 
>> If members ask for the feature I'm sure we would consider it.
> 
> Out of curiosity, are members asking about W3C WebAuthn? [1] That's 
> where the authentication space seems to be headed at the moment.
> 

Speaking entirely personally here, I've been playing with TOTP and 
Webauthn authentication flows in the past couple of weeks.  The idea 
seems good, but as Scott points out, the main issue is that you need a 
usable means of registering the tokens in the first place.  There may be 
a way to do that on a separate trusted site, although I suspect it would 
be hard to make that code sufficiently generic for widespread use.

I've not used Duo, but it seems to solve the registration problem pretty 
well, at the expense of an ongoing cost per user.  It also didn't 
support U2F/Webauthn, but apparently now has support for it.

-- 
Dr Robert Bradley
Identity and Access Management Team, IT Services, University of Oxford