Strange issue with MFA library for PrivacyIDEA

[Matt Brennan]

I actually have privacyIDEA working pretty well with IdP 4.0.1. I also had
to make changes to the plugin to support IdP 4 -- it wouldn't even compile
for me. I submitted a pull request to the maintainer back in June but never
heard anything (in case it's useful to you, PR is here:
https://github.com/wraezor/privacyIDEA-shibboleth-tfa/pull/6). I did also
make some edits to the velocity templates to provide a better user
experience. I can probably share those if you think they'd be useful.

One major issue I have discovered is the endpoint it uses. By default it
uses the authentication test endpoint, which means disabling a token
doesn't actually prevent it from working ... but, in response to Scott's
comment, at 3+ months the login flows actually have been working great.
*knocks on wood*

On my list is still to find a way to integrate the Yubikey libraries so we
can enroll those instead of relying solely on TOTP.

-Matt


On Wed, Sep 23, 2020 at 2:32 PM Darren Boss <darren.boss at computecanada.ca>
wrote:

> You are right, I accidentally mounted the views to view instead of
> views so they really were missing those views. After fixing that error
> and turning off CSRF, it worked with our test PrivacyIDEA deployment.
> I'll probably fork this repo and fix the CSRF issue. If we continue
> down this road, the UI text will have to be presented in both French
> and English which it doesn't support at the moment.
>
> On Wed, Sep 23, 2020 at 10:22 AM Cantor, Scott <cantor.2 at osu.edu> wrote:
> >
> > On 9/23/20, 10:05 AM, "users on behalf of Darren Boss" <
> users-bounces at shibboleth.net on behalf of darren.boss at computecanada.ca>
> wrote:
> >
> > >    There are privacyidea.vm and login-pi-error.vm templates as part of
> > >    the repo which I've added to views.
> >
> > I would have to say that's impossible just based on a cursory glance at
> the flow, and the error. It's failing to find the view and falling through
> to looking for a JSP view. So the Velocity view isn't there.
> >
> > Obviously, I'm not "supporting" this in any sense, and I would issue a
> pretty blunt warning: I've virtually never seen a third party login flow
> without major bugs. That's not a criticism of anything but our lack of
> documentation (and the relative complexity of getting them right).
> >
> > I will certainly file it away for review as a starting point when I get
> around to looking at PrivacyIdea in depth later.
> >
> > -- Scott
> >
> >
> > --
> > For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> > To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>
>
> --
> Darren Boss
> Senior Programmer/Analyst
> Programmeur-analyste principal
> darren.boss at computecanada.ca
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200923/30f4d778/attachment.htm>