April 2021 - Adfstoolkit-dev

by johan.peterson＠liu.se

Hi, I have pushed branch #127-Add_RefedsMFA_SFA with language support. It should now be ready for RC. If you have the possibility to test the commands: Install-ADFSTkAdapter Get-ADFSTkAdapter Uninstall-ADFSTkAdapter Please do. 👍 I have one thing left to discuss: To force MFA I create an Access Control Policy: ADFSToolkit - Permit everyone and force MFA It needs a name. Is it important that the name has language support? If not all is good. If so we need to change how it is created and enabled for the SP:s in Add-ADFSTkSPRelyingPartyTrust.ps1. I can’t enable it with the ID, I need the name so in that case I first have to search for the ACP with the ID to get the name and then enable it on the SP with the name. It feels a bit messy to do so for all SP:s. Caching is always an option though 😊 What do you think? Best regards Johan Peterson IT-Architect [Linköping University] IT Department s-581 83 Linköping Phone: +46 (0)13-28 57 30 Mobile: +46 (0)703 222 405 Visiting address: Galaxen Building Please visit us at www.liu.se<http://www.liu.se/>

3 years, 7 months

1
0
0 0

added federation-settings repo to fedtools

by Chris.Phillips＠canarie.ca

Hi.. With the improvements Johan applied to the get-FederationDefaults helper, a single endpoint can contain multiple federations settings. I was working with both InCommon in a ticket and in slack with IDEM (Italy) settings for their test federation and went and configured them as well in the settings file. The repo can be found here: https://github.com/fedtools/federation-settings This is from my work location in my @teamktown github account so I’m not sure how up to date the SWAMID snapshot is. I suspect it is not the latest appropriate one. Please feel free to update it. It’s also specifically named neutrally so it can be used for more than just ADFSToolkit for federation settings like these. The ADFSToolkit docs in step 1 of the install are updated (here: https://github.com/fedtools/adfstoolkit/blob/master/doc/README.md ) to use this zip off the main branch. We may want to consider releases on it as I suspect others will want to set up their own for their federation as pull requests. Chris..

3 years, 8 months

1
0
0 0

Mtg Notes: April 7: reviewing code structure to capture MFA into v2.1.0

by Chris.Phillips＠canarie.ca

Notes from April 7 standing dev meeting Attendees: Chris Phillips (CANARIE), Johan Peterson (SUNET) Topics: Continued review of code repo structure for v2.1.0 - MFA work Discussion/table top thought experiment: ‘how sustainable are our technical design decisions with the MFA items/approach?’ Notes: JP+CP: reviewed the proposed Modular separation experiemental structure (ie use a separate module) Conclusion by mid mtg by JP+CP: not very sustainable because: We would want to use this more intimately than a separate package Eg. have MFA specific directives in the customizations and LocalManualSPSettings do interesting things Separate modules breeds unnecessary duplication of code (e.g. Write-host, logging, lang packs etc) Convergence is actually quite small and not unnatural We already have assistive publish PowerShell items Only adds 3 more public methods and an included dll, code base in git will have /src for full transparency. Next steps on this front Johan opened ticket for work: https://github.com/canariecaf/adfstoolkit/issues/127 ( Add the ability to support RefedsMFA/SFA in the Toolkit ) Additional discussion about REFEDS MFA in a hybrid configuration was had Alignment to REFEDS MFA behaviour was discussed If from our codebase trigger an MFA to do the second factor trigger things, it will be more aligned to the REFEDS MFA This is similar to the Freya technique The ADFS operator has to apply the MFA rules specifically for the entity. JP+CP discussed the techniques to apply the MFA as a way to test the sustainability of the design

3 years, 8 months

1
0
0 0

2024

2023

2022

2021

Adfstoolkit-dev April 2021