privacyIDEA is a

two factor authentication Multi-factor authentication (MFA; encompassing two-factor authentication, or 2FA, along with similar terms) is an electronic authentication method in which a user is granted access to a website or application only after successfully presenting ...

system which is multi-tenency- and multi-instance-capable. It is

opensource Open source is source code that is made freely available for possible modification and redistribution. Products include permission to use the source code, design documents, or content of the product. The open-source model is a decentralized so ...

, written in Python and hosted at

GitHub GitHub, Inc. () is an Internet hosting service for software development and version control using Git. It provides the distributed version control of Git plus access control, bug tracking, software feature requests, task management, continuous ...

. privacyIDEA is a LinOTP's fork from 2014.

Fields of use

privacyIDEA provides an authentication backend for various kinds of applications (including

SSH The Secure Shell Protocol (SSH) is a cryptographic network protocol for operating network services securely over an unsecured network. Its most notable applications are remote login and command-line execution. SSH applications are based on a ...

VPN A virtual private network (VPN) extends a private network across a public network and enables users to send and receive data across shared or public networks as if their computing devices were directly connected to the private network. The be ...

, as well as web applications such as ownCloud). Thus it is meant to replace classical proprietary two factor authentication systems such as RSA

SecurID RSA SecurID, formerly referred to as SecurID, is a mechanism developed by RSA for performing two-factor authentication for a user to a network resource. Description The RSA SecurID authentication mechanism consists of a " token"—either ...

or Vasco. It supports

single sign-on Single sign-on (SSO) is an authentication scheme that allows a user to log in with a single ID to any of several related, yet independent, software systems. True single sign-on allows the user to log in once and access services without re-enterin ...

via

SAML Security Assertion Markup Language (SAML, pronounced ''SAM-el'', ) is an open standard for exchanging authentication and authorization data between parties, in particular, between an identity provider and a service provider. SAML is an XML-based m ...

. It is also possible to login with a second factor to Windows desktops using a privacyIDEA Credential Provider.

Installation

privacyIDEA runs on-premises as a web application on a Linux system. It can be set up quickly and easily. It can run on Debian, Ubuntu and RedHat.

Authentication devices

privacyIDEA supports a wide variety of authentication devices. Amongst those are hardware tokens like Feitian C200, the

Yubikey The YubiKey is a hardware authentication device manufactured by Yubico to protect access to computers, networks, and online services that supports one-time passwords (OTP), public-key cryptography, and authentication, and the Universal 2nd Fact ...

by Yubico or other U2F/

WebAuthn Web Authentication (WebAuthn) is a web standard published by the World Wide Web Consortium (W3C). WebAuthn is a core component of the FIDO2 Project under the guidance of the FIDO Alliance. The goal of the project is to standardize an interface fo ...

devices. Many smartphone apps compliant with

HOTP HMAC-based one-time password (HOTP) is a one-time password (OTP) algorithm based on HMAC. It is a cornerstone of the Initiative for Open Authentication (OATH). HOTP was published as an informational IETF RFC 4226 in December 2005, documenting th ...

and TOTP are also supported.

References

{{Reflist Computer security software Authentication methods Computer access control Linux