[JIRA] Commented: (SIDP-519) Switching between multiple login handlers cause first context to be sticky in Shib-Authentication-Method

[Scott Cantor (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/SIDP-519?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13531#comment-13531 ] 

Scott Cantor commented on SIDP-519:
-----------------------------------

There is no such attribute, this is about the AuthnContext in the assertion. The AuthenticationEngine doesn't do any checking when the login module doesn't explicitly set an AuthenticationMethod in a request attribute. It just uses whatever the attemped method was in the LoginContext.

The only way to know what actually happened is to ensure that every login module sets a method attribute on the way back out so the engine knows what actually happened. That will require a documentation change and extension authors knowing to make the fix in their own code.

I guess alternatively there could be some code added to verify which login module actually ran, but I think that would require just as many extension changes.

> Switching between multiple login handlers cause first context to be sticky in Shib-Authentication-Method 
> ---------------------------------------------------------------------------------------------------------
>
>                 Key: SIDP-519
>                 URL: https://issues.shibboleth.net/jira/browse/SIDP-519
>             Project: Shibboleth IdP 2 - Java
>          Issue Type: Bug
>      Security Level: Standard(Standard bug, may impact functionality but does not represent a security vulnerability ) 
>          Components: Authentication
>    Affects Versions: 2.3.2, 2.3.3
>         Environment: Linux 2.6.35-30-server, 64-bit. OpenJDK 1.6.0_20, tomcat 6.0.32
> IdP extensions: Multi Factor Login Handler, MongoDB connector
>            Reporter: Stefan
>            Assignee: Chad La Joie
>
> I have two login handlers, one is UserPassword and the other is MultiFactor (2FA). The problem I have is that the first authn context loaded is the one that seem to get sticky when Shib-Authentication-Method attribute is released to the SP.
> Example:
> The SP request MultiFactor handler but the user decide to manually override it by editing the URL from /MultiFactor to /UserPassword and then completes the login using one factor. Now I expect to be Shib-Authentication-Method = urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport, but instead it's Shib-Authentication-Method = urn:oasis:names:tc:SAML:2.0:ac:classes:Token. And vice versa if the SP request UserPassword and the user change it to MultiFactor.
> I have tried requesting a login handler from the SP or letting the IdP choose a default login handler both with same result.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira