Skip to content

Changes

Page history
Convert all external links to Markdown authored by Etienne Dysli Metref's avatar Etienne Dysli Metref
Hide whitespace changes
Inline Side-by-side
toolbox_archive.md
View page @ cc108825
......@@ -8,12 +8,12 @@
## Project locations ##
* This wiki
* Issues, planning and roadmap on [[https://forge.switch.ch/projects/idpv3-mfa|SWITCH Forge]]
* Source code on [[https://gitlab.switch.ch/etienne.dysli-metref/idpv3-mfa|SWITCH's GitLab]]<code bash>git clone https://gitlab.switch.ch/etienne.dysli-metref/idpv3-mfa.git</code>
* Issues, planning and roadmap on [SWITCH Forge](https://forge.switch.ch/projects/idpv3-mfa)
* Source code on [SWITCH's GitLab](https://gitlab.switch.ch/edu-id/idpv3-mfa)<code bash>git clone https://gitlab.switch.ch/edu-id/idpv3-mfa.git</code>
## Test accounts with OTP ##
Test accounts for use on [[https://mfa-dev.ed.switch.ch/index.html|mfa-dev]]
Test accounts for use on [mfa-dev](https://mfa-dev.ed.switch.ch/index.html)
^ Username ^ Password ^ TOTP seed (base32) ^
| ''student1'' | ''password1'' | ''QJWAYZKBYCEGOTMLVLHRWK2XR5GER4YO'' |
| ''student2'' | ''password2'' | ''HDRCSSKZFXBBEMVT5DY74JIB425NAEZJ'' |
......@@ -36,8 +36,8 @@ Test accounts for use on [[https://mfa-dev.ed.switch.ch/index.html|mfa-dev]]
### Considerations about Shibboleth and the SAML environment ###
* Connection between a login flow and [[ http://docs.oasis-open.org/security/saml/v2.0/saml-authn-context-2.0-os.pdf | SAML Authentication Context Classes ]]. What class to use for a new flow?
* Is it possible to combine login flows (sequence, alternative, choice, ...)? if so, how? Answer from devs: [[https://shibboleth.net/pipermail/dev/2015-July/006954.html|no]].
* Connection between a login flow and [SAML Authentication Context Classes](http://docs.oasis-open.org/security/saml/v2.0/saml-authn-context-2.0-os.pdf). What class to use for a new flow?
* Is it possible to combine login flows (sequence, alternative, choice, ...)? if so, how? Answer from devs: [no](https://shibboleth.net/pipermail/dev/2015-July/006954.html).
* Flow support for forced authentication and passive authentication.
* Where does the verification of the second factor happen? Inside or outside the IdP process? Are existing extension points sufficient?
......@@ -142,9 +142,9 @@ Voici cependant quelques compléments qui ont été discutés en séance:
### Questions ###
* Is it possible to specify the desired authentication method (SAML authnContextClassRef) on specific URLs in the Apache configuration?\\ **Yes**, according to [[https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig|NativeSPApacheConfig]], any [[https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPContentSettings|content setting]] can be given with the ''ShibRequestSetting'' directive, in particular ''authnContextClassRef'', ''authnContextComparison'' and ''forceAuthn''. Additionally, it is possible to request more than one authentication method.
* Is it possible to specify the desired authentication method (SAML authnContextClassRef) on specific URLs in the Apache configuration?\\ **Yes**, according to [NativeSPApacheConfig](https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApacheConfig), any [content setting](https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPContentSettings) can be given with the ''ShibRequestSetting'' directive, in particular ''authnContextClassRef'', ''authnContextComparison'' and ''forceAuthn''. Additionally, it is possible to request more than one authentication method.
* Same question as above with "force authentication".\\ **Yes** with ''ShibRequestSetting forceAuthn true'', see above.
* Is there a session timeout per authentication method on the SP?\\ **Yes**, but not directly. Session timeouts can be changed per application (in the SP sense). For example, An [[https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride|ApplicationOverride]] could specify a [[https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions|Sessions]] element with MFA-specific timeouts (available settings are ''lifetime'', ''timeout'' and ''maxTimeSinceAuthn''), then this application can be referenced in the Apache configuration with ''ShibRequestSetting applicationId foo''.
* Is there a session timeout per authentication method on the SP?\\ **Yes**, but not directly. Session timeouts can be changed per application (in the SP sense). For example, An [ApplicationOverride](https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride) could specify a [Sessions](https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessions) element with MFA-specific timeouts (available settings are ''lifetime'', ''timeout'' and ''maxTimeSinceAuthn''), then this application can be referenced in the Apache configuration with ''ShibRequestSetting applicationId foo''.
### more meetings ###
......