[jboss-jira] [JBoss JIRA] (ELY-20) Where does OTP fit into realms?

[Jan Kalina (JIRA)]

    [ https://issues.jboss.org/browse/ELY-20?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13090778#comment-13090778 ] 

Jan Kalina commented on ELY-20:
-------------------------------

FileSystemSecurityRealm now can contain credentials of more types - passwords, private-keys and certificates - what if we add one-time-password by same way?

Do it as optional part of existing SecurityRealms would be better then implement special OtpLdapSecurityRealm, OtpFileSystemSecurityRealm etc...

> Where does OTP fit into realms?
> -------------------------------
>
>                 Key: ELY-20
>                 URL: https://issues.jboss.org/browse/ELY-20
>             Project: WildFly Elytron
>          Issue Type: Sub-task
>            Reporter: Darran Lofthouse
>            Assignee: Jan Kalina
>             Fix For: 1.0.0.Beta1
>
>
> Will investigate further once we have a pure LDAP impl in.
> We could have an architecture where we have an LDAP server that is then referenced by an OTP server or we could have the two somehow combined into one.
> There are also requirements related to marking a token as used or token invalidation after too many bad attempts - this may be handled within the OTP server but for stronger authentication mechanisms may need to be more involved otherwise this becomes another case of falling back to PLAIN / BASIC auth.



--
This message was sent by Atlassian JIRA
(v6.3.15#6346)