[JIRA] Commented: (SIDP-519) Switching between multiple login handlers cause first context to be sticky in Shib-Authentication-Method

[ratler@idp.protectnetwork.org (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/SIDP-519?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13538#comment-13538 ] 

ratler at idp.protectnetwork.org commented on SIDP-519:
----------------------------------------------------

I'm not sure which of the proposed changes that would be the best. But I still believe it need to be fixed, it's a real issue not only due to the fact you can't verify which method was really used but it also make the whole point of having multiple login handlers useless. This way I cannot in a simple manner verify which auth method was used in the application on the SP side. Nor can I release attributes based on auth method using  <basic:Rule xsi:type="basic:AuthenticationMethodString" value="urn:oasis:names:tc:SAML:2.0:ac:classes:Token" /> in a filter policy because obviously its not always true.


> Switching between multiple login handlers cause first context to be sticky in Shib-Authentication-Method 
> ---------------------------------------------------------------------------------------------------------
>
>                 Key: SIDP-519
>                 URL: https://issues.shibboleth.net/jira/browse/SIDP-519
>             Project: Shibboleth IdP 2 - Java
>          Issue Type: Bug
>      Security Level: Standard(Standard bug, may impact functionality but does not represent a security vulnerability ) 
>          Components: Authentication
>    Affects Versions: 2.3.2, 2.3.3
>         Environment: Linux 2.6.35-30-server, 64-bit. OpenJDK 1.6.0_20, tomcat 6.0.32
> IdP extensions: Multi Factor Login Handler, MongoDB connector
>            Reporter: ratler at idp.protectnetwork.org
>            Assignee: Chad La Joie
>
> I have two login handlers, one is UserPassword and the other is MultiFactor (2FA). The problem I have is that the first authn context loaded is the one that seem to get sticky when Shib-Authentication-Method attribute is released to the SP.
> Example:
> The SP request MultiFactor handler but the user decide to manually override it by editing the URL from /MultiFactor to /UserPassword and then completes the login using one factor. Now I expect to be Shib-Authentication-Method = urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport, but instead it's Shib-Authentication-Method = urn:oasis:names:tc:SAML:2.0:ac:classes:Token. And vice versa if the SP request UserPassword and the user change it to MultiFactor.
> I have tried requesting a login handler from the SP or letting the IdP choose a default login handler both with same result.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira