available plugins for MFA integration

[Peter Schober]

Off-topic, only relates to the software privacyIDEA (a self-hosted MFA
token managagement web app) and neither the Shibboleth IDP nor its
integration with privacyIDEA:

* Scott Cantor <cantor.2 at osu.edu> [2023-04-05 14:17]:
> Unfortunately I don't see PriviacyIDEA as being too viable, the UI
> is just awful. A common model is to require passwords for initial
> enrollment and MFA subsequently to manage tokens, and it didn't even
> seem to support that (but it was so complicated to set up, I
> couldn't say for sure).

FWIW, that's "easily" possible by adding a policy of scope
"authentication" that's setting the "passthru" parameter to
"userstore" (or to some previously configured RADIUS server):
https://privacyidea.readthedocs.io/en/latest/policies/authentication.html#passthru
My own policy literal doing just this is as follows (and can be
imported (with adjusting the realm) using the 'pi-admin policy
p_import' subcommand): 

pi-manage policy p_export -n auth-userstore-without-token 2>/dev/null 
{   'policy': [   {   'action': {'passthru': 'userstore'},
                      'active': True,
                      'adminrealm': [],
                      'adminuser': [],
                      'check_all_resolvers': False,
                      'client': [],
                      'conditions': [],
                      'name': 'auth-userstore-without-token',
                      'pinode': [],
                      'priority': 5,
                      'realm': ['myrealm'],
                      'resolver': [],
                      'scope': 'authentication',
                      'time': '',
                      'user': []}]}


I think on top of that you'd then need to add a policy for scope
"webui" that's setting 'login_mode' to value 'privacyIDEA':
https://privacyidea.readthedocs.io/en/latest/policies/webui.html#login-mode

That works for me but does not take into consideration deactivated
tokens, i.e., when a subject has tokens assigend but all are inactive
(which might be an edge case you don't need to care for, esp. if you
don't intend allow end-users to disable/renable their own tokens).
  I've been trying to add apprporiate 'conditions' to that policy in
order to make it apply only if an active token is available ('token',
'active', '>', '0'", in PI-policy-condition-speak) but getting
errors[1] I have not found a workaround for.

So on that front it seems to be very flexible if only you can find out
what how to tell the system from reading what essentially is merely
API documentation. (That could easily be fixed with a bit more
hands-on or task-focussed documentation, of course.)

> When I discussed [fudiscr] with the author, it emerged that it
> didn't yet support FIDO (which is the real goal of all this), but
> was in progress.

Both 'fudiscr' and privacyIDEA support webauthn these days, AFAIK.
I haven't tried this yet but U2F seems to work fine. (Modulo seemingly
always having to set a PIN on U2F tokens which then triggers the U2F
flow in the web browser?)

Best,
-peter

[1] Policy 'mypolicyname' has conditions on tokens, but a token object is not available.