[JIRA] Commented: (SIDP-519) Switching between multiple login handlers cause first context to be sticky in Shib-Authentication-Method

[Scott Cantor (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/SIDP-519?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13540#comment-13540 ] 

Scott Cantor commented on SIDP-519:
-----------------------------------

I agree, I think it's pointless to add a "type" system based on the actual login handler when we already select the handler based on AuthenticationMethod and support returning that to the engine.

We do have to take care that the login handlers know what method they're supposed to be handling and not just echo back what the LoginContext is tracking.

> Switching between multiple login handlers cause first context to be sticky in Shib-Authentication-Method 
> ---------------------------------------------------------------------------------------------------------
>
>                 Key: SIDP-519
>                 URL: https://issues.shibboleth.net/jira/browse/SIDP-519
>             Project: Shibboleth IdP 2 - Java
>          Issue Type: Bug
>      Security Level: Standard(Standard bug, may impact functionality but does not represent a security vulnerability ) 
>          Components: Authentication
>    Affects Versions: 2.3.2, 2.3.3
>         Environment: Linux 2.6.35-30-server, 64-bit. OpenJDK 1.6.0_20, tomcat 6.0.32
> IdP extensions: Multi Factor Login Handler, MongoDB connector
>            Reporter: ratler at idp.protectnetwork.org
>            Assignee: Chad La Joie
>
> I have two login handlers, one is UserPassword and the other is MultiFactor (2FA). The problem I have is that the first authn context loaded is the one that seem to get sticky when Shib-Authentication-Method attribute is released to the SP.
> Example:
> The SP request MultiFactor handler but the user decide to manually override it by editing the URL from /MultiFactor to /UserPassword and then completes the login using one factor. Now I expect to be Shib-Authentication-Method = urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport, but instead it's Shib-Authentication-Method = urn:oasis:names:tc:SAML:2.0:ac:classes:Token. And vice versa if the SP request UserPassword and the user change it to MultiFactor.
> I have tried requesting a login handler from the SP or letting the IdP choose a default login handler both with same result.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira