Hybrid MFA: Balancing On‑Premise Control and Cloud Integration with privacyIDEA
summary
privacyIDEA is an on‑premise MFA system extended to a hybrid setup that centralizes tokens and policies while integrating cloud IdPs. Implementation details include a user resolver using Azure AD Graph API, an authentication bridge via Keycloak OpenID Connect and an alternative path through ADFS federation, plus a protocol mapper to make responses acceptable to Entra ID. Built with Python back end and Angular TypeScript front end, it supports TOTP/HOTP, U2F, push, passkeys and RADIUS VPNs and is available on GitHub.
AI-written summary · about
chapters (9)
- 0:00privacyIDEA and hybrid MFA
- 1:40privacyIDEA core features
- 3:23Token types in privacyIDEA
- 4:27Configuring policies
- 5:52On-premise MFA choice
- 8:02Hybrid authentication need
- 9:28privacyIDEA with Azure AD
- 14:45Centralized hybrid MFA benefits
- 15:54Q&A
related talks
51mCentrally managed Multi Factor Authentication with privacyIDEA
01h 00mMulti-Factor Authentication on the Cutting Edge
19mAdvanced Authentication Framework
26mHolistic Authentication
28mBuilding Identity for an Open Perimeter
22mPhising resistant MFA
30mIAM on Hybrid Cloud: Next Generation Security Model to Create an Interoperable Cloud [I]
17mImplementing Multi-factor Authentication