<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
On May 21, 2014, at 11:01 AM, Mike Wiseman <<a href="mailto:mike.wiseman@utoronto.ca">mike.wiseman@utoronto.ca</a>> wrote:<br>
<div><br class="Apple-interchange-newline">
<blockquote type="cite">
<div style="margin: 0cm 0cm 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
The relying party requires username/password for all applications and OTP for a subset. The username is different from the institutional username so a separate idp that works with the RP environment will be deployed. The OTP service uses the institutional username
only. So the idp/MCB needs to handle the RP-related username, look up the institutional username and then offer an OTP login to the user. Will MCB keep track of the RP-related username? Can the LDAP lookup be done before the OTP login?<o:p></o:p></div>
<br class="Apple-interchange-newline">
</blockquote>
</div>
<div><br>
</div>
<div>You'll pretty much have to do what David L mentioned, have the OTP submodule handle the principal translation. The MCB/Shib principal will be what the RP wants, so you'll have to do a look up to find the other principal name for the OTP validation or have
(and educate) the users to use their standard principal name during the OTP step, but not set a new principal name when you do.</div>
<div><br>
</div>
<div>Paul</div>
<div><br>
</div>
<br>
<div apple-content-edited="true">Paul Hethmon<br>
Chief Software Architect<br>
<a href="mailto:paul.hethmon@clareitysecurity.com">paul.hethmon@clareitysecurity.com</a><br>
<br>
</div>
<br>
</body>
</html>