Google Authenticator for CAS and Shibb IdPs

[IAM David Bantz]

Been asked by Management essentially
"CAS appears able to use Authenticator for MFA SSO; why not Shibboleth?"

raised in the context of merging our SSO operation (to reduce complexity to
maintain and enhance user experience); most of our apps and federation
access rely on Shibb, but Banner ERP and closely related apps use CAS.
Independently, CISO hopes to require MFA for administrative access to
Banner ERP, and hopes to do it without licensing Duo (purely cost
consideration).

>From what I can tell, the Google Authenticator in Apereo CAS (
https://apereo.github.io/cas/5.1.x/installation/GoogleAuthenticator-Authentication.html)
makes CAS an MFA *provider* maintaining device registrations, secret keys,
etc. (but not supporting PUSH AFAICT), so fundamentally different from
Shibb Duo plugin.

I'm asking for sanity check of my understanding, any updates on possible
Authenticator/Shibboleth integration and additional considerations to
inform management/executive decisions re SSO and MFA for Banner.

David Bantz
UA OIT IAM
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200218/e20ea4a2/attachment.html>