<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<meta content="text/html; charset=UTF-8">
<style type="text/css" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Helvetica,sans-serif">
<p><span>Pardon my ignorance, but I'm curious where one can find information on Maryland's Duo AuthAPI? I've seen it mentioned on here a few times with respect to usage with ECP but I'm having trouble finding information about it.</span></p>
<p><span><br>
</span></p>
<p><span>Thanks!</span></p>
<p><br>
</p>
<div id="x_Signature">
<div id="x_divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:rgb(0,0,0); font-family:Calibri,Arial,Helvetica,sans-serif,EmojiFont,"Apple Color Emoji","Segoe UI Emoji",NotoColorEmoji,"Segoe UI Symbol","Android Emoji",EmojiSymbols">
<p></p>
<div>--</div>
<div>Brandon McKean</div>
<div>IT / Systems</div>
<div>Linux Administrator</div>
<br>
<p></p>
</div>
</div>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Wessel, Keith <kwessel@illinois.edu><br>
<b>Sent:</b> Tuesday, March 27, 2018 5:14:35 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> RE: Best way to protect ECP endpoints</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">Scott,<br>
<br>
Alright, I feel quite stupid! I never tried just commenting out the Apache Location block for the ECP endpoint and hitting it to see what happens. Works like a charm: prompts for authentication, honors cookies, and even uses Maryland's Duo AuthAPI to do a second
factor.<br>
<br>
Not too often that I can fix something by unconfiguring things.<br>
<br>
Thanks, and sorry for the silly question.<br>
<br>
Keith<br>
<br>
-----Original Message-----<br>
From: users <users-bounces@shibboleth.net> On Behalf Of Cantor, Scott<br>
Sent: Tuesday, March 27, 2018 3:43 PM<br>
To: Shib Users <users@shibboleth.net><br>
Subject: Re: Best way to protect ECP endpoints<br>
<br>
On 3/27/18, 4:38 PM, "users on behalf of Wessel, Keith" <users-bounces@shibboleth.net on behalf of kwessel@illinois.edu> wrote:<br>
<br>
> Looking at the docs on the wiki, it appears things haven't changed too much since V2:<br>
<br>
I guess that depends what you think about the differences, but in practice auto-configuring and enabling it with no external login is a pretty major change.<br>
<br>
> First, as we plan to move our IdP to AWS, we'll be getting Apache out <br>
> of the picture, fronting Jetty with an Amazon elastic load balancer instead of an httpd. Seems like the perfect opportunity to move to container-level auth.<br>
<br>
Strong no. The IdP does authentication, just let it.<br>
<br>
> Second, we'd love if our ECP endpoint would have a chance to honor IdP <br>
> cookies of existing valid sessions before passing requests on to perform HTTP basic auth.<br>
<br>
It does, there just aren't any clients likely to support it.<br>
<br>
> I know the first item is doable. One sentence on the above web page <br>
> confuses me, though: "If you are only using password-based <br>
> authentication, there is really nothing further for you to configure." Is this implying that I can just set up container-based HTTP basic auth in Jetty and add the endpoint to my web.xml?<br>
<br>
No, it's saying you don't have to do that anymore.<br>
<br>
> The last couple blocks in web.xml seem to imply this -- theones before <br>
> support for legacy login.sjp. Or is there a way for the IdP to handle <br>
> HTTP basic auth for the ECP endpoint without configuring anything container-level, using the same authn configuration that it uses to validate passwords submitted through the UI?<br>
<br>
Yes, that's what it does.<br>
<br>
> If the latter is true, it seems that honoring of cookies would also be doable.<br>
<br>
It does,<br>
<br>
> Question is what is the basic recommendation for setting up ECP these <br>
> days if you're doing password authentication on your ECP endpoint?<br>
<br>
The recommendation is to do nothing. The problem is MFA, which is why I asked Maryland to license their Duo AuthAPI integration.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
For Consortium Member technical support, see <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=iZ_ekq9_90q96juMacb0Sg&m=F1MCm2_skYF4vBPa6_3S0xfsuiDyypN63sTsvTQxNMM&s=HrKZgbg1-gTwx8EVzsIDne3obdWLx3TdggwIpzT5gmU&e=">
https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=iZ_ekq9_90q96juMacb0Sg&m=F1MCm2_skYF4vBPa6_3S0xfsuiDyypN63sTsvTQxNMM&s=HrKZgbg1-gTwx8EVzsIDne3obdWLx3TdggwIpzT5gmU&e=</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
-- <br>
For Consortium Member technical support, see <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=iZ_ekq9_90q96juMacb0Sg&m=F1MCm2_skYF4vBPa6_3S0xfsuiDyypN63sTsvTQxNMM&s=HrKZgbg1-gTwx8EVzsIDne3obdWLx3TdggwIpzT5gmU&e=">
https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwICAg&c=eLbWYnpnzycBCgmb7vCI4uqNEB9RSjOdn_5nBEmmeq0&r=iZ_ekq9_90q96juMacb0Sg&m=F1MCm2_skYF4vBPa6_3S0xfsuiDyypN63sTsvTQxNMM&s=HrKZgbg1-gTwx8EVzsIDne3obdWLx3TdggwIpzT5gmU&e=</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font>
</body>
</html>