<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
</head>
<body bgcolor="#ffffff" text="#000000">
Hello All,<br>
<br>
The Shibboleth SSO is setup in our environment and it is plugged with
TFA module as documented at
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/SHIB2/Multi+Factor+Login+Handler">https://wiki.shibboleth.net/confluence/display/SHIB2/Multi+Factor+Login+Handler</a><br>
<br>
Now the login.config file in the IDP has the entry to activate TFA,<br>
<i><br>
// Second factor - Added for TFA in Shibboleth<br>
com.yubico.jaas.HttpOathOtpLoginModule <b>required</b><br>
protectedUrl = <a class="moz-txt-link-rfc2396E" href="http://sp.example.org/oath-protected/">"http://sp.example.org/oath-protected/"</a><br>
expectedOutput = "Authenticated OK.";</i><br>
<br>
We use LDAP for first factor authentication. By default the TFA is
activated for all users. Now there is a need to activate TFA for only
few users in the LDAP. Is this possible and such flexibility available
in this TFA module by Yubico?<br>
If so, what is the line of configuration to be added?<br>
<br>
Any suggestions would be much appreciated.<br>
<br>
- Badri
</body>
</html>