[JIRA] Commented: (SIDP-519) Switching between multiple login handlers cause first context to be sticky in Shib-Authentication-Method

[Chad La Joie (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/SIDP-519?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13539#comment-13539 ] 

Chad La Joie commented on SIDP-519:
-----------------------------------

I believe the best route is to require each login handler to return the mechanism it executed.  Anything else is going to massively complicated I think.

> Switching between multiple login handlers cause first context to be sticky in Shib-Authentication-Method 
> ---------------------------------------------------------------------------------------------------------
>
>                 Key: SIDP-519
>                 URL: https://issues.shibboleth.net/jira/browse/SIDP-519
>             Project: Shibboleth IdP 2 - Java
>          Issue Type: Bug
>      Security Level: Standard(Standard bug, may impact functionality but does not represent a security vulnerability ) 
>          Components: Authentication
>    Affects Versions: 2.3.2, 2.3.3
>         Environment: Linux 2.6.35-30-server, 64-bit. OpenJDK 1.6.0_20, tomcat 6.0.32
> IdP extensions: Multi Factor Login Handler, MongoDB connector
>            Reporter: ratler at idp.protectnetwork.org
>            Assignee: Chad La Joie
>
> I have two login handlers, one is UserPassword and the other is MultiFactor (2FA). The problem I have is that the first authn context loaded is the one that seem to get sticky when Shib-Authentication-Method attribute is released to the SP.
> Example:
> The SP request MultiFactor handler but the user decide to manually override it by editing the URL from /MultiFactor to /UserPassword and then completes the login using one factor. Now I expect to be Shib-Authentication-Method = urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport, but instead it's Shib-Authentication-Method = urn:oasis:names:tc:SAML:2.0:ac:classes:Token. And vice versa if the SP request UserPassword and the user change it to MultiFactor.
> I have tried requesting a login handler from the SP or letting the IdP choose a default login handler both with same result.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira