available plugins for MFA integration (was: Re: Enabling MFA on Shibboleth IDP 4.01)

[Peter Schober]

A bit over a year ago there was a discussion about MFA plugins:
https://shibboleth.net/pipermail/users/2022-February/051674.html
which I'd like to provide some (belated) update to.

* Scott Cantor <cantor.2 at osu.edu> [2022-02-21 15:35]:
> If there's demand for a PrivacyIdea plugin, there are several we can
> work from as a starting point for doing an official one.

For self-hosting (which some are required to do) there don't seem to
be too many alternatives and in the Free/Libre/Opensource world
there's no real alternative to privacyIDEA if you need to support more
than TOTP.  So yes, I think there's (ever growing) demand for that.
(E.g. we're currently seeing a rush to MFA deployments after a series
of breakins and ransomware incidents at universities here. Possibly
due to a lack of known/supported integrations for the IDP in some
cases the IDP has been moved behind an MFA-handling VPN service,
forcing the whole institutional population through VPN even for
off-site / federated resource access in order to get to the IDP.)

As to several such plugins existing:

I think most of this started with
https://github.com/cyber-simon/idp-auth-linotp (by Michael Simon from
https://www.kit.edu/) which a local university reportedly was still
able to use as a starting point for their IDPv4 integration.
(I've asked them to provide the necessary changes to the community
somewhere but haven't heard back so far.)
  The code published above has been updated somewhat here:
https://github.com/wraezor/privacyIDEA-shibboleth-tfa
but this too is now abandoned as can be seen here:
https://github.com/wraezor/privacyIDEA-shibboleth-tfa/pull/6
Though there at least someone says "I am using the plugin, in
production, on IdP 4.0.1 with the code in this PR".
  (The repo at https://github.com/idGain/privacyIDEA-shibboleth-tfa
also contains very few minor fixes over the wraezor repo but
those are burried in unrelated formatting and package renaming changes.)

Other than that lineage of code there's now this:
https://doku.tid.dfn.de/en:shibidp:plugin-fudiscr
which is actively being developed (for a change) and used by several
institutions in production.
There's no source available yet but AFAIR the idea/promise always was
to publish it under a Free/Libre/Opensource license when it's done.

* Scott Cantor <cantor.2 at osu.edu> [2022-02-21 16:28]:
> >    Might make sense to start collecting them in the wiki?
> 
> That's fine, but use [1], not our plugin space. That's basically documentation for our plugins.

I've finally gotten around to adding a link for this to the
"Contributions and Extensions" wiki page at
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631834/Contributions+and+Extensions
Hopefully that will get a few more eyeballs on that project.

Best regards,
-peter