2 factor authentication for EGW portal and client certs

Harondel_J_Sibble-2 2014-12-01 21:38:01 UTC #1

Currently don’t allow external access to EGW 14.1 but want to more securely
via www and esync.

What’s the appropriate way to implement both and/or client certificates
(mutual client/server authentication) and 2 factor authentication?

Harondel J. Sibble
Sibble Computer Consulting Ltd.
Creating Solutions for the small and medium business computer user.
harondel@pdscc.com (use pgp keyid 0x3CC3CFCE not 0x3AD5C11D)
http://www.pdscc.com
Blog: http://www.pdscc.com/blog
(604) 739-3709 (voice)

Download BIRT iHub F-Type - The Free Enterprise-Grade BIRT Server
from Actuate! Instantly Supercharge Your Business Reports and Dashboards
with Interactivity, Sharing, Native Excel Exports, App Integration & more
Get technology previously reserved for billion-dollar corporations, FREE
http://pubads.g.doubleclick.net/gampad/clk?id=157005751&iu=/4140/ostg.clktrk

eGroupWare-users mailing list
eGroupWare-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-users

Ralf_Becker_Stylite 2014-12-13 10:08:21 UTC #2

Hi Harondel,

Currently don’t allow external access to EGW 14.1 but want to more securely
via www and esync.

What’s the appropriate way to implement both and/or client certificates
(mutual client/server authentication) and 2 factor authentication?

2-factor auth was considered for 14.2, but has been postponed for 15.1.

It is definitely on our agenda and will come beginning of 2015.

Ralf

–
Ralf Becker
Director Software Development

Stylite AG

Morschheimer Strasse 15 | Tel. +49 6352 70629 0
D-67292 Kirchheimbolanden | Fax. +49 6352 70629 30

Email: rb@stylite.de

www.stylite.de | www.egroupware.org

Managing Directors: Andre Keller | Ralf Becker | Gudrun Mueller
Chairman of the supervisory board: Prof. Dr. Birger Leon Kropshofer

VAT DE214280951 | Registered HRB 31158 Kaiserslautern Germany

Harondel_J_Sibble 2014-12-14 17:55:55 UTC #3

Thanks Ralf, that’s good to know.

Are you planning to make your own 2fa add-on or allow api (SAML in particular) integration so we
can use our 2fa solution of choice?

We use or have used the following for 2fa and SSO.

Google Authenticator
https://en.wikipedia.org/wiki/Google_Authenticator

Auth Anvil
http://www.scorpionsoft.com/

DuoSecurity
http://guide.duosecurity.com/

Centrify
http://www.centrify.com/solutions/saas-mobile-single-sign-on.asp

Ideally, I’d hope it’s generic enough that we can just plugin whichever tool we want to use.

What about clients certs for mutual authentication. I assume that’s something that would be
better handled at the Apache/TLS level…

Hi Harondel,

Currently don’t allow external access to EGW 14.1 but want to more securely
via www and esync.

What’s the appropriate way to implement both and/or client certificates
(mutual client/server authentication) and 2 factor authentication?

2-factor auth was considered for 14.2, but has been postponed for 15.1.

It is definitely on our agenda and will come beginning of 2015.

Ralf

–
Ralf Becker
Director Software Development

Stylite AG

Morschheimer Strasse 15 | Tel. +49 6352 70629 0
D-67292 Kirchheimbolanden | Fax. +49 6352 70629 30

Email: rb@stylite.de

www.stylite.de | www.egroupware.org

Managing Directors: Andre Keller | Ralf Becker | Gudrun Mueller
Chairman of the supervisory board: Prof. Dr. Birger Leon Kropshofer

VAT DE214280951 | Registered HRB 31158 Kaiserslautern Germany

–
Harondel J. Sibble
Sibble Computer Consulting Ltd.
Creating Solutions for the small and medium business computer user.
harondel@pdscc.com (use pgp keyid 0x3CC3CFCE not 0x3AD5C11D)
http://www.pdscc.com
Blog: http://www.pdscc.com/blog
(604) 739-3709 (voice)

eGroupWare-users mailing list
eGroupWare-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/egroupware-users

Ralf_Becker_Stylite 2014-12-15 08:15:50 UTC #4

Hi Harondel,

Thanks Ralf, that’s good to know.

Are you planning to make your own 2fa add-on or allow api (SAML in particular) integration so we
can use our 2fa solution of choice?

We use or have used the following for 2fa and SSO.

Google Authenticator
https://en.wikipedia.org/wiki/Google_Authenticator
I looked into that one and liked it, as it is available for Android and
iOS phones.

I also looked into U2F (Universal 2nd Factor):
https://fidoalliance.org/specifications/download

I definitely want to implement a cookie allowing to use as (or better
skip) 2nd factor for know “computers”.

As our authentication already uses plugins, I would also use plugins for
2nd factor and some admin defined policy what you have to fulfill to be
logged in.

Auth Anvil
http://www.scorpionsoft.com/

DuoSecurity
http://guide.duosecurity.com/

Centrify
http://www.centrify.com/solutions/saas-mobile-single-sign-on.asp

Ideally, I’d hope it’s generic enough that we can just plugin whichever tool we want to use.

What about clients certs for mutual authentication. I assume that’s something that would be
better handled at the Apache/TLS level…
Client certs are already possible, nothing new.