passive auth and login handlers

[Paul Hethmon]

On 8/11/11 3:19 PM, "Cantor, Scott E." <cantor.2 at osu.edu> wrote:

>On 8/11/11 3:10 PM, "Paul Hethmon" <paul.hethmon at clareitysecurity.com>
>wrote:
>>14:54:31.459 - ERROR
>>[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:517]
>>- [http-172.16.14.246-16380-1:] - Authentication failed with the error:
>>edu.internet2.middleware.shibboleth.idp.authn.AuthenticationException:
>>Passive authentication not supported without a previous session.
>
>This log message gets sent out right before it returns control to the
>profile handler. That's supposed to pick it up and send back a SAML error
>(or whatever the profile decides to do).

I think what I'm looking for is a way to convey this in the Response:

  <samlp:Status>
    <samlp:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder">
      <samlp:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:NoPassive" />
    </samlp:StatusCode>
  </samlp:Status>


With what I'm doing now, I instead get:

   <saml2p:Status>
      <saml2p:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:Responder">
         <saml2p:StatusCode
Value="urn:oasis:names:tc:SAML:2.0:status:AuthnFailed"/>
      </saml2p:StatusCode>
   </saml2p:Status>


I don't see a way for my Login Handler to tell Shib to use the "NoPassive"
failure code instead of the "AuthnFailed".

It's probably a bit pedantic on my part, as the relying party handles it
fine now.

Paul