<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle19
{mso-style-type:personal;
font-family:"Calibri",sans-serif;}
span.EmailStyle20
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Or use it indirectly via shibboleth, which is how we interface with DUO…<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Ric<o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">--<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="color:black">Ric Anderson</span></b><span style="color:black">| <b>Systems Administrator</b>
<img width="15" height="15" style="width:.1562in;height:.1562in" id="Picture_x0020_2" src="cid:image001.png@01D491FD.28C883D0" alt="Description: Description: Description: Description: Description: Description: Description: http://redbar.web.arizona.edu/logos/images/thumb_pawprints.gif"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">Research And Discovery Tech | HPC Systems Support<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black">XSEDE Campus Champion<o:p></o:p></span></p>
<p class="MsoNormal"><u><span style="font-size:11.0pt;color:black"><a href="mailto:Ric@email.arizona.edu">ric@email.arizona.edu</a> </span></u><u><span style="font-size:11.0pt;color:#AFABAB">(V): +1-520-626-1642</span></u><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;color:black"><img border="0" width="160" height="39" style="width:1.6666in;height:.4062in" id="Picture_x0020_1" src="cid:image002.png@01D491FD.28C883D0" alt="cid:image005.png@01D01593.CF7DFA60"></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> <o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:black">From: </span></b><span style="color:black">OOD-users <ood-users-bounces+ric=email.arizona.edu@lists.osc.edu> on behalf of "Dockendorf, Trey via OOD-users" <ood-users@lists.osc.edu><br>
<b>Reply-To: </b>"Dockendorf, Trey" <tdockendorf@osc.edu>, User support mailing list for Open OnDemand <ood-users@lists.osc.edu><br>
<b>Date: </b>Wednesday, December 12, 2018 at 7:49 AM<br>
<b>To: </b>"Lilley, John F." <johnbot@caltech.edu>, User support mailing list for Open OnDemand <ood-users@lists.osc.edu><br>
<b>Subject: </b>Re: [OOD-users] Open OnDemand with LDAP/Duo auth<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt">While we have not tested Duo with OnDemand there are a few ways I can imagine it working. First would be using Keycloak OpenID Connect for authentication to OnDemand and having Keycloak do the LDAP authentication.
There is a plugin someone posted to Keycloak mailing list [1] some time ago that may allow Duo to work with Keycloak. We do use Keycloak for OnDemand but not the Duo portion. Another option that may be possible is using Duo’s LDAP proxy [2] and then configure
something like Keycloak to do LDAP authentication through the Duo LDAP proxy.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Keycloak supports 2FA but not using Duo. We have lightly tested basic 2FA with Keycloak at OSC but not something we’ve deployed to production.</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">- Trey</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">[1]: https://github.com/mulesoft-labs/keycloak-duo-spi</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">[2]: https://duo.com/docs/ldap</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">-- </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Trey Dockendorf</span><o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">HPC Systems Engineer</span><o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><span style="font-size:10.5pt;color:black">Ohio Supercomputer Center</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="color:black">From: </span></b><span style="color:black">OOD-users <ood-users-bounces+tdockendorf=osc.edu@lists.osc.edu> on behalf of "Lilley, John F. via OOD-users" <ood-users@lists.osc.edu><br>
<b>Reply-To: </b>"Lilley, John F." <johnbot@caltech.edu>, User support mailing list for Open OnDemand <ood-users@lists.osc.edu><br>
<b>Date: </b>Tuesday, December 11, 2018 at 5:13 PM<br>
<b>To: </b>"ood-users@lists.osc.edu" <ood-users@lists.osc.edu><br>
<b>Subject: </b>[OOD-users] Open OnDemand with LDAP/Duo auth</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt">Hello All, </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Performing a test installation of Open OnDemand on our central hpc to compare performance and functionality against StarNet FastX. We use ldap along with duo as the second factor. Does OpenOndemand support
this type of installation and if so, are there documents/notes/wikis describing this configuration floating around?</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Thank You,</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">John</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">-- </span><o:p></o:p></p>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt">John Lilley</span></b><o:p></o:p></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt">C A L I F O R N I A I N S T I T U T E O F T E C H N O L O G Y</span></b><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt">Lead Systems Administrator – Cloud and High Performance Computing | IMSS</span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><a href="mailto:nelsonhs@caltech.edu">johnbot@caltech.edu</a> | 323.208.1688</span><o:p></o:p></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
<p class="MsoNormal"><span style="font-size:11.0pt"> </span><o:p></o:p></p>
</div>
</body>
</html>