-
Notifications
You must be signed in to change notification settings - Fork 37
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Login form and OTP integration #104
Comments
Not overkill but there are other modules that can do that and circle back to mod_auth_gssapi. |
I'm not sure how the circle back would work. For instance, MAG doesn't seem to register as a authnz provider for use in mod_auth_form... |
@adelton can you comment on the above idea ? |
@shaohme, could you provide some mod_auth_form configuration that you envision to be used with the OTP setup? |
@adelton The current mod_auth_form code doesn't seem to be able to handle it. I was thinking about modifying or forking the code to be able to take httpd_username, httpd_password, and https_otp optional, or maybe N times httpd_ variables. These variables gets passed along to modules who needs them. Either these variables needs to be presented all on one HTML form, or username + password on one HTML page, and OTP input on another page. This because MIT-KRB5 first need a FAST established, then asks for principal, then the OTP challenge.
mod_auth_form keeps a state of where the client are in the auth process locally (by cookie's perhaps?), and redirects the user to the next url, perhaps with query (/auth?stage=[0,1,2,3....]), on which she submits the next load of values, until the process is done. |
I think it would be nice if we expose our basic-auth API as an authentication provider by implementing a check_password() function and registering it via ap_register_auth_provider(AUTHN_PROVIDER_GROUP). This will allow it to be use as a parameter to AuthFormProvider and also allow it to be stacked along with other basic authentication providers in AuthBasicProvider directive (and perhaps other advantages such as alternative caching via mod_authn_socache). As regarding additional OTP, I think it could be provided via other config / module directly. |
In general, |
Just a suggestion;
Would it be overkill to integrate a login form instead of just basic auth fallback, and support OTP from MIT KRB5 in same auth form?
The text was updated successfully, but these errors were encountered: