Correlating two auth levels

[virgil.chereches]

I have the following SA setup: a set of resources protected with AD credentials and with a second RADIUS auth server (OTP).

I must add that one OTP token is shared by multiple users (so we do not have a one to one mapping of users and tokens).

I need to control which users authenticate with some tokens (in the sense that a group of users must use only few tokens to log in). I thought about using custom expressions in order to achieve this but I have some difficulties in handling multivalued LDAP attributes, specifically with separator syntax (as can be read in Admin guide): <variable sep='str'>. Where must this be defined: in server catalog or in mapping rule?

How I can use this to simply use a LDAP multi-valued attribute in building a string like 'string1' or 'string2' or 'string3' and compare with [email protected] auth server?

[zanyterp_]

I don't think you will be able to do this as there is no checking during authentication/authorization of the token other than making sure it is valid on the IVE. If the backend server can monitor, that would work. Otherwise, on the SA I don't think it will be possible.

The attribute string goes in the server definition.

[virgil.chereches · Accepted solution]

I found an easy way to implement this. All you must do is to extend the AD schema with some multi-valued attribute, AuthToken let's say and populate user entries in AD with the OTP corresponding users. Then change (if not already) AD authentication in JSA with a LDAP based auth server and add this attribute (AuthToken) to LDAP Server Catalog attributes.

All you must do now is to change the default custom expression on Role mapping tab with:

[email protected]{RadiusAuth} [email protected]{LDAPAuth}.AuthToken

where RadiusAuth is OTP auth server and LDAPAuth is AD auth server.

Quite simple, isn't it?

[zanyterp_]

Thank you for sharing the information; I apologize for not realizing this could be done.