Any 4.x Authentication Module Contributions/Extensions?

[Krug, Jeff]

I totally overlooked there was a whole new confluence space for plugins.  Thank you!  The totp one should be a good basis for me, as my  old 3.x authentication module was based on a TOTP extension.


I am trying to get the old plugin to work on a completely fresh IDP4 install; it's not an upgrade and the lack of general-authn.xml was the root of my initial confusion, as that was how I wired it up in the past.  Although it sounds like there might be an easy button if I just a add a general-authn.xml file to a clean shibboleth 4.1 install (and probably change something else to load that file), although I still plan to look at the TOTP plugin to see if there is a cleaner way to do that.


Thanks,

Jeff



________________________________
From: Cantor, Scott <cantor.2 at osu.edu>
Sent: Monday, May 10, 2021 6:19 PM
To: Shib Users
Cc: Krug, Jeff
Subject: Re: Any 4.x Authentication Module Contributions/Extensions?

The IDPPLUGINS space has two, TOTP and the Duo plugins, the TOTP one is pretty minimal.

I don't know why an existing one wouldn't be "run", that's nothing to do with the code really. The old configuration should apply just fine (you'd have a general-authn.xml file with the list of flow beans and the extension would be defined there).

A *new* install is different, and the difference is outlined in the Authentication topic, but that's not the assumption if you're porting a plugin up.

>I suspect that my problem is that I am not doing the IdPModule stuff correctly (that seems to be new to 4.x),
> but the abstractness of that documentation left me a bit unsure of how to fix what I have.

No, nothing to do with it. Unless you're planning to distribute and maintain the extension for others to install and upgrade, none of that is really important or all that useful.

> I glanced at the 4.1 source code and idp-conf-impl project in particular, but it felt a tad overwhelming.  I'll keep
> looking at it, but I am not sure I am going to figure it out from that code or not.

That's not a good example to follow , it has access to things that a plugin can't. The actual plugins include the layouts that would be required to auto-register the login flow and the necessary definitions.

A jar doesn't have to implement the module or plugin layers to be used, that just allows for managed installation and activation.

-- Scott


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210510/613c3fe1/attachment.htm>