MFA on IDP 5.1.1

[Dave Perry]

What he said.

I got SAML proxying (so we benefit from SSO from Office 365/Entra ID AND our security guys got the MFA) working under IdP v4, with support from Jisc (it seems one or two things were missing from cookbooks, and there were a couple of lines missing from the v4 config I inherited when I started at my current employer).

Not sure how different this would be, if you're doing it from scratch under v5 - but a lot of the Azure / Entra ID setup side will be the same surely.

HTH
Dave

_________________________________________________

Dave Perry
Application Analyst  |  Innovation & Technology Services

York St John University

Lord Mayor’s Walk, York, YO31 7EX
T: +44(0)1904 876 0000
d.perry1 at yorksj.ac.uk<mailto:d.perry1 at yorksj.ac.uk>  |  www.yorksj.ac.uk<http://www.yorksj.ac.uk/>

[cid:e0bef7dc-5b22-4369-b702-bd9b9ab1d83f]

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott via users <users at shibboleth.net>
Sent: Thursday, August 22, 2024 12:39 PM
To: Shib Users <users at shibboleth.net>
Cc: Cantor, Scott <cantor.2 at osu.edu>
Subject: Re: MFA on IDP 5.1.1

Caution: Please take care when clicking on links or opening attachments in emails that originate from outside of the university. When in doubt, contact the ITS service desk.


> Is it possible to integrate IDP 5.1.1 with Entra ID for MFA at
> ease without complicating the setup?

That depends on what you consider complicated. Doing that requires SAML proxying, you can't use the IdP for one factor and theirs for a second, it's not Duo.

-- Scott


--
For Consortium Member technical support, see https://eur02.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C02%7Cd.perry1%40yorksj.ac.uk%7C918e60c0643f4888b73d08dcc29f2829%7C5c8ae38ef85b4309b7ec862815a37aee%7C0%7C0%7C638599236054878995%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=j%2FxPKaGZun4VJ0Aq8r3pmzMBPOrG7wiAxDn4nbelXc4%3D&reserved=0<https://shibboleth.atlassian.net/wiki/x/ZYEpPw>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240827/283a3178/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: Outlook-qibff1zw.png
Type: image/png
Size: 12155 bytes
Desc: Outlook-qibff1zw.png
URL: <http://shibboleth.net/pipermail/users/attachments/20240827/283a3178/attachment.png>