passive auth and login handlers

[Peter Williams]

We struggled with previousSession. Its semantics are highly ambiguous.

My final conclusion (2+ years ago) was that the signal has no impact on the formal state machine of SAMl2. It thus does not qualify the likes of IsPassive, etc.

At the end of the day, we treated it as an end-end authContext. If you are confirmed to have an IDP session, it authenticate you - being the challenge that one passes. It proves you have a web cookie, that is. Nobody (in 10+ SAML vendor integrations, and 100+ deployments) has ever used the code path in 2 years, but I think minted assertion has authContext = previousSession, if reqAuthnContext == previousSession.

Id been tempted to do/design things like: if requested-authnContext ==  previousSession && IDP session establishes web cookie is presented, then  do, for sp-init request, an unsolicited idp-initiated response, with new SAML session id. This made SAML have a feature semantically similar to the SSL session duplication feature, in the https profile (Mozilla compatible sub-profile). But, I felt it was all too much of a bridge too far. SAML's secure messaging model is not SSL/https; being a totally classical, writer-to-reader design.

From: dev-bounces at shibboleth.net [mailto:dev-bounces at shibboleth.net] On Behalf Of Paul Hethmon
Sent: Thursday, August 11, 2011 12:10 PM
To: Shibboleth Dev
Subject: passive auth and login handlers

I've combined support for previous session and authentication into a single login handler. Given that combination, my handler has to handle passive session requests in its role as handling previous session. I've got this all working ok, but Shib still throws an exception when the user does not have a previous session and hence I can't authenticate them. Something like this:

14:54:31.448 - INFO [com.clareity.jaguar.shibboleth.authn.ClareityLoginHandler:237] - [http-172.16.14.246-16380-1:] - Passive authentication requested without a valid SSO session. Returning SAML error to
SP [http://www.narrpr.com]
14:54:31.450 - ERROR [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:549] - [http-172.16.14.246-16380-1:] - Error returned from login handler for authentication method urn:oasis:names:
tc:SAML:2.0:ac:classes:Password:
Passive authentication not supported without a previous session.
14:54:31.459 - ERROR [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:517] - [http-172.16.14.246-16380-1:] - Authentication failed with the error:
edu.internet2.middleware.shibboleth.idp.authn.AuthenticationException: Passive authentication not supported without a previous session.
        at edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine.validateSuccessfulAuthentication(AuthenticationEngine.java:551) [shibboleth-identityprovider-2.1.5-slo7.jar:na]
        at edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine.completeAuthentication(AuthenticationEngine.java:503) [shibboleth-identityprovider-2.1.5-slo7.jar:na]

Now, everything seems to work ok, but I feel I must be missing something in how I convey the reason for the failure to Shib. I'm seeing the error message in the appropriate attribute and thats what the AuthenticationEngine keys on to throw the exception.

So, am I doing this right?

thanks,

Paul

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20110811/05e909f6/attachment-0001.html