[JIRA] (IDP-1924) SSO Session reuse strategy

[Scott Cantor (Jira)]

Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) *resolved* as *Won't Do*

I addressed on Slack why this is both not needed and already implemented in a different, more granular way.

Repeating my comments for posterity:

For one thing, the session is not relevant here, it's just a container for AuthenticationResults.

Those are the relevant objects you want to manage the reuse of, not the session. Turning off the session is just a brute force way of outright preventing all reuse of the results.

Secondly, the IdP already does all this for you automatically when it's configured with the right supportedPrincipals settings and when the results get built with the right AuthnContextClassRefPrincipal objects and there's a ton of control over that.

No new features are needed, it's a configuration task.

It is not simple to do at times because it often depends on the user and service and other factors, but we all face similar issues making MFA work, it's the same problem in the end.

The problem I think is that I don't know that you're in a position to provide a deployment specific scenario to work through because all of this is a very local matter in the end, you have to have specifics to work through how it needs to be configured. There's no recipe to follow, just general designs and features that tend to be common across some deployments, but there are always local complications.

But bottom line, the IdP will never issue a response if the combination of AuthenticationResults does not carry a Principal that satisfies a RequestedAuthnContext or essential ACR claim. It's hardwired to prevent that. So the scenario you mention is flat out banned automatically unless the IdP is misconfigured.

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiOTJmMDA3MWNiNzBiNDc1MDljOTI4YjJmZjY2NGU4NDYiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/IDP-1924?atlOrigin=eyJpIjoiOTJmMDA3MWNiNzBiNDc1MDljOTI4YjJmZjY2NGU4NDYiLCJwIjoiaiJ9 ) IDP-1924 ( https://shibboleth.atlassian.net/browse/IDP-1924?atlOrigin=eyJpIjoiOTJmMDA3MWNiNzBiNDc1MDljOTI4YjJmZjY2NGU4NDYiLCJwIjoiaiJ9 ) SSO Session reuse strategy ( https://shibboleth.atlassian.net/browse/IDP-1924?atlOrigin=eyJpIjoiOTJmMDA3MWNiNzBiNDc1MDljOTI4YjJmZjY2NGU4NDYiLCJwIjoiaiJ9 )

Change By: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) Resolution: Won't Do Status: Open Resolved

( https://shibboleth.atlassian.net/browse/IDP-1924#add-comment?atlOrigin=eyJpIjoiOTJmMDA3MWNiNzBiNDc1MDljOTI4YjJmZjY2NGU4NDYiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1924#add-comment?atlOrigin=eyJpIjoiOTJmMDA3MWNiNzBiNDc1MDljOTI4YjJmZjY2NGU4NDYiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100197- sha1:46df9a5 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20220325/024a5187/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-9f3744f7-3f4d-458e-83a0-2edb193149b5
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220325/024a5187/attachment-0003.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-6afa2f5e-a453-4cc6-9a41-171590fbbeaa
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220325/024a5187/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-160b64a9-e34b-4b37-8e76-22af464be80c
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20220325/024a5187/attachment-0005.png>