2 posts tagged with "MFA"

Open-source nginx has no CAS module, so "nginx CAS authentication" in practice means one of two setups. Either nginx asks an authentication service about every request through its auth_request module, and Casdoor answers (directly at /api/forward-auth, or through casdoor-forward-auth or OAuth2 Proxy), or the app behind nginx is itself a CAS client and talks to Casdoor's CAS server endpoints. If you can rebuild nginx, the Casdoor nginx module runs the login inside nginx, and if you'd rather not run nginx at all, Casdoor's site proxy can sit in front of the app. In every case the login page is Casdoor's, so one SSO session, one set of permissions and one MFA policy cover all the apps.

To put multi-factor authentication in front of a VPN with RADIUS, the VPN gateway sends the username and password to the RADIUS server with PAP, the server checks the password and answers with an Access-Challenge, the client shows a prompt, and the user types the 2FA code from an authenticator app into a second request. Casdoor ships a RADIUS server that does exactly this for users who have TOTP set up, so a gateway that can show an Access-Challenge prompt (FortiGate SSL VPN is one whose vendor documents it) gets a password plus a 2FA code without any extra software. Wi-Fi with WPA2/WPA3-Enterprise is different: 802.1X runs over EAP, which has no place for a typed code, so Casdoor has a switch to skip the code for those clients.