jaas authentication failover

[Liam Hoekenga]

On Thu, Mar 28, 2019 at 7:38 PM Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 3/28/19, 7:38 PM, "users on behalf of Liam Hoekenga" <
> users-bounces at shibboleth.net on behalf of liamr at umich.edu> wrote:
>
> > The guest accounts aren't currently allowed to use MFA, and in the
> current configuration, if someone tries a guest
> > account, I see an error in my log...
>
> It's better to deal with MFA logic well outside JAAS or the Password flow.
> The MFA layer is where that kind of work belongs. If you're talking Duo,
> that's something the MFA scripting can handle invoking selectively, it
> shouldn't impact anything near the JAAS bits.
>

I simplified the JAAS configuration based on your suggestion to set the
JAASDefaultLoginConfigurations's "second" properties to null.
That seemed to do the trick.  It also fixed an issue I was having when
throwing the GEANT OIDC plugin into the mix.

I still wonder, though, is there anything left over in some context that
says "user authenticated with JAASGuestLoginConfigurations" vs "user
authenticated with JAASKerberosLoginConfigurations"?  I can make a rough
guess by looking at the principal name itself (has an "@"), but I'd kind of
like something more authoritative?

Liam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190329/3ff1687f/attachment.html>