[JIRA] (IDP-1924) SSO Session reuse strategy

[Simone Avogadro (Jira)]

Simone Avogadro ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A60a84ee1-4961-471b-99d8-f67c05e24403 ) *created* an issue

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiM2YxYjUzNTM4NTI0NDc0OWFmM2Q2YzliZTkzY2MzNmYiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/IDP-1924?atlOrigin=eyJpIjoiM2YxYjUzNTM4NTI0NDc0OWFmM2Q2YzliZTkzY2MzNmYiLCJwIjoiaiJ9 ) IDP-1924 ( https://shibboleth.atlassian.net/browse/IDP-1924?atlOrigin=eyJpIjoiM2YxYjUzNTM4NTI0NDc0OWFmM2Q2YzliZTkzY2MzNmYiLCJwIjoiaiJ9 ) SSO Session reuse strategy ( https://shibboleth.atlassian.net/browse/IDP-1924?atlOrigin=eyJpIjoiM2YxYjUzNTM4NTI0NDc0OWFmM2Q2YzliZTkzY2MzNmYiLCJwIjoiaiJ9 )

Issue Type: Bug Affects Versions: 4.1.5 Assignee: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) Components: Session Created: 25/Mar/22 3:50 AM Priority: Trivial Reporter: Simone Avogadro ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A60a84ee1-4961-471b-99d8-f67c05e24403 )

After the tests which followed raising https://shibboleth.atlassian.net/browse/JOIDC-84 we had some internal discussion on the best approach around how to deal with scenarios where the AuthContextClassRef is used to map LOAs (Levels Of Assurance)

This scenario is particularry relevant since SAML2 (and now OIDC) in EU are used as foundation of the eIDAS authentication standards and in both cases the LOAs are mapped to AuthContextClassRef. So reusing an existing authentication from LOA1 to give accesso to LOA2+ SPs cannot be allowed.

The current solution is simply to disable Shibboleth SSO and thus completely reimplement it manually (which is less then trivial).

We’re here raising awareness on this potential use-case and proposing what seems a simple solution.

We propose to introduce a configurable (bean) which will be in charge to decide is the user needs to re-authenticate or if the authentication from the current session can be re-used.

The semantics would be:

* the bean has access to Session information (at least AuthContextClassRef) and AuthnRequestContext information
* the bean returns true only if the current session can be re-used to satisfy the incoing request
* if the bean returns false the current session will be discarded and the user will be re-authenticated to create a new one (this is needed to correctly address SSO in scenarios where the first login uses LOA1 but all the following one use LOA2)

( https://shibboleth.atlassian.net/browse/IDP-1924#add-comment?atlOrigin=eyJpIjoiM2YxYjUzNTM4NTI0NDc0OWFmM2Q2YzliZTkzY2MzNmYiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1924#add-comment?atlOrigin=eyJpIjoiM2YxYjUzNTM4NTI0NDc0OWFmM2Q2YzliZTkzY2MzNmYiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100197- sha1:46df9a5 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220325/5fc45814/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-f03848d9-0a5e-4bd5-ad42-4643b7db7923
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220325/5fc45814/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-ae0cc8d7-6dac-447c-8fc0-dc980015aa72
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220325/5fc45814/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-c9e8b6c9-5652-4b1b-aa5a-5c5f0cd6a2d6
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220325/5fc45814/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-a3c59112-1f48-4f0f-aa7d-73e1502d92da
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220325/5fc45814/attachment-0007.png>