Enabling MFA on Shibboleth IDP 4.01

[Cantor, Scott]

>    Seems there's now an IDP plugin available from a third party (Freie
>    Universität Berlin) to integrate with privacyIDEA via its API (web
>    page in German only):

There are a few of them, I don't know whether any of them are built properly or not. Our lack of development documentation makes any third party code suspect, obviously.

>    I've just learned of this and so haven't tried it myself. Also I don't
>    know whether that satisfies your criteria for "fully practical
>    solution". I don't see why not.

I think PrivacyIdea appears to be pretty bad as an end-user interface for managing tokens, but that's a subjective view. It aims to provide that functionality, so yes, it provides the missing pieces that just implementing some sort of validation scheme doesn't.

This is, again, why we haven't just implemented WebAuthn yet. That doesn't do anything super useful when you can't manage the tokens, and we are not equipped as a project to build and maintain such a thing. Privacy Idea has its own weird way of integrating with it for WebAuthn support, but when I evaluated the UI I was so put off that I didn't see it as a viable path.

-- Scott