Multiple 2FA mechanism in Shibboleth

[Nate Klingenstein]

Phani,

The multi-factor authentication flow is really, in my experience, best thought of as a programmatic means of controlling how the authentication process is executed.  You should be able to write an MFA implementation that has both logical paths embedded in it and a script that has the logic to proceed properly.  Just check the relying party entityID from the authentication context in a script and transition into proper flows accordingly and make sure the right Principal is set.

There is no complete "documentation" on how to do this because there's an arbitrary number of use cases and authentication mechanisms in the world and making a compendium would be impossible.  You have to be able to understand how the MFA login flow works and write the flows, logic, and script yourself.  There are, however, multiple useful examples and thorough documentation on the architecture of the entire mechanism.

https://wiki.shibboleth.net/confluence/display/IDP4/MultiFactorAuthnConfiguration#MultiFactorAuthnConfiguration-ProgrammaticallySelectingFlows
https://wiki.shibboleth.net/confluence/display/IDP4/PredefinedBeans#PredefinedBeans-RelyingParty-BasedContextFunctions

Be particularly careful when writing this script to ensure you don't signal 2FA was performed when it wasn't.

Take care,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id

-----Original message-----
From: Phanieshwar Nalluri
Sent: Tuesday, March 23 2021, 10:36 pm
To: Shib Users
Subject: Multiple 2FA mechanism in Shibboleth

Hello All,

We use NAM and Shibboleth for SSO at Boston College. We currently use NAM with 2FA and Shib with DUO separately for two factor authentication.

I'm looking for a possibility to use Shib integration options to add additional second authentication flow to use internal 2FA. If an application doesn't require 2FA it'll go to NAM and if it doesn't work then it should go to Shib+Duo for 2FA.

Is there any documentation on how to add secondary authentication flow in addition to an existing multi factor authentication mechanism? I tried different Google articles available but nothing concrete could be found and reaching out to all of you for any valid inputs to point me in the right direction.

Appreciate your help and have a great day.

Phani

--

For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net