Change 539336 had a related patch set uploaded (by Jbond; owner: John Bond):
[operations/puppet@production] apereo_cas: add ability to use groovy script to determine MFA

https://gerrit.wikimedia.org/r/539336

The upstream PR i have is to support multiple MFA providers, further i have just created a script to use groovy to to the select the mf provider based on an ldap attribute.

that said if we only want to support one provider we could do something like the following

cas.authn.mfa.globalPrincipalAttributeNameTriggers=memberOf
cas.authn.mfa.globalPrincipalAttributeValueRegex=mfa

Then anyone who was a member of the mfa ldap group would have mfa enabled. We would need to update build.gradle so we only had one supported mfa provider.

Although i think it would be useful to support multiple mfa providers. cas configurations allows you to deny services based on a user not having MFA. allowing something like TOTP creates a bridge until people have there HW token. further we could still ensure resources are only accessible with u2f as well. as in we could have services that allow access with:

• no 2fa
• 2fa but i dont care what 2fa
• 2fa but it must be u2f

Also usefull https://github.com/apereo/cas/pull/4188

also raised this on the mailing list

John and I have discussed next steps on IRC: Initially we'll make U2F opt-in via a memberOf/LDAP check. At a later step we'll add TOTP support (ideally in a way that allows to import the existing registrations from the wikitech endpoint) and by then we'll need MFA selection either by means of the Groovy script or via the selector support included in 6.1: https://apereo.github.io/2019/05/13/cas61x-mfa-selection-strategies/

Change 539515 had a related patch set uploaded (by Jbond; owner: John Bond):
[operations/puppet@production] apereo_cas: configure to used MFA based obn ldap group membership

https://gerrit.wikimedia.org/r/539515

Change 539515 merged by Jbond:
[operations/puppet@production] apereo_cas: configure to used MFA based on ldap group membership

https://gerrit.wikimedia.org/r/539515

Change 539336 merged by Jbond:
[operations/puppet@production] apereo_cas: add ability to use groovy script to determine MFA

https://gerrit.wikimedia.org/r/539336

In T233937#5529214, @MoritzMuehlenhoff wrote:

John and I have discussed next steps on IRC: Initially we'll make U2F opt-in via a memberOf/LDAP check. At a later step we'll add TOTP support (ideally in a way that allows to import the existing registrations from the wikitech endpoint) and by then we'll need MFA selection either by means of the Groovy script or via the selector support included in 6.1: https://apereo.github.io/2019/05/13/cas61x-mfa-selection-strategies/

Opt-in U2F support can now be selected via the LDAP user attribute "mfa-method=u2f". (Other 2FA options can be figured in the same manner, but are currently disabled in our build).

The MFA method is enabled via a Groovy script via the cas.authn.mfa.globalPrincipalAttributesPredicate config option.

Other options which were evaluated are:

• cas.authn.mfa.globalPrincipalAttributenameTriggers / cas.authn.mfa.globalPrincipalAttributenameTriggers/Regex: This didn't work as expected, the Regex never matched as the code in question always bailed out with the error that it matches against a single-valued attribute. John submitted a related PR, which they couldn't reproduce, this could be fixed in 6.1.0, can be retested later.
• The https://apereo.github.io/2019/05/13/cas61x-mfa-selection-strategies/#selection-menu feature didn't work, it never gets displayed. Maybe this also needs 6.1.0, we can re-test this later as well. But for most scenarios a centrally configured MFA method seems totally adequate, the selection feature is more of a corner case.

@Volans just asked if there is a way to register multiple u2f devices to the same account. Of the top of my head im not sure how to achive that but placing a not here as something to investigate

In T233937#5696427, @jbond wrote:

@Volans just asked if there is a way to register multiple u2f devices to the same account. Of the top of my head im not sure how to achive that but placing a not here as something to investigate

Just a bit of a note, since I asked for this exact thing on IRC. It'd be cool to be able to select from more than one U2F token. :)

Just a bit of a note, since I asked for this exact thing on IRC. It'd be cool to be able to select from more than one U2F token. :)

As mentioned on IRC, it is possible to add this functionality to CAS, although it would require adding some hooks to the auth process so we could allow the user to pick which token they wish to use.; Although I think that before we even start considering features like this we need to have a good user management portal so users can register, remove and choose there default u2f token.