Enabling MFA on Shibboleth IDP 4.01

[Peter Schober]

* Cantor, Scott <cantor.2 at osu.edu> [2022-02-21 15:07]:
> >    Seems there's now an IDP plugin available from a third party (Freie
> >    Universität Berlin) to integrate with privacyIDEA via its API (web
> >    page in German only):
> 
> There are a few of them, I don't know whether any of them are built
> properly or not. Our lack of development documentation makes any
> third party code suspect, obviously.

Well, what could be done to improve that situation, then?
I haven't talked to the folks from Berlin yet but I guess making sure
it meets the project's criteria can't be bad? Probably depends on
future maintainership of that code, cf. the OIDC work from CSC/GEANT.

> Privacy Idea has its own weird way of integrating with it for
> WebAuthn support, but when I evaluated the UI I was so put off that
> I didn't see it as a viable path.

ACK, though privacyIDEA's web UI is simply one way to excercise the
underlying API and get started more quickly. As with e.g. Grouper
(cough!) I guess anyone making heavier use of the application would
eventually integrate via the API and not by exposing the default web
UI itself.

-peter