Question about Shibboleth and MFA - Google Authenticator

[Etienne Dysli Metref]

On 16/02/2019 01.44, Greg Haverkamp wrote:
> Another option, if you want all sorts of other components, is LinOTP
> (and at least one derivative), which is free and open
> source: https://github.com/LinOTP/LinOTP.

Indeed a "token backend" is good idea to support multiple second
factors. We use LinOTP's fork PrivacyIDEA over here, which we've
integrated through its API with the IdP -- to verify OTPs -- and our
account management webapp, so users can register tokens themselves. This
allowed us to easily support SMS OTP* and we're about to roll out OATH
TOTP as well with little additional effort (though our IdP flow is
likely to start knowing about token types, which I'd prefer to
avoid...). I've already done the same kind of integration with RADIUS
instead of PrivacyIDEA's HTTP API to verify OTPs with another "token
backend".

  Etienne

* Yeah, I know, SMS OTP isn't recommended any more, but it was the
easiest for us to get started with.


-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/users/attachments/20190219/9f60c6d7/attachment.sig>