Modify forceAuthn Authentication Engine Behavior

[John Mitchell]

All,

    I would like to change the behavior of the authentication engine in
the IdP when it comes to how it handles the forceAuthn attribute.
Looking at the docs it does not appear that there is a way to extend or
replace the authentication engine and I wish to leave the current login
handlers and the IdP session length as it is. So I would like to make
the following change to the completeAuthentication method in the
AuthenticationEngine class:

from:
            if (loginContext.isForceAuthRequired()) {
                validateForcedReauthentication(idpSession,
actualAuthnMethod, subject);

                // Reset the authn instant.
                if (actualAuthnInstant == null) {
                    actualAuthnInstant = new DateTime();
                }
            }

to:
            if (loginContext.isForceAuthRequired()) {
                Subject oldSubject = idpSession.getSubject();
                oldSubject.getPrincipals().clear();
                oldSubject.getPublicCredentials().clear();
                oldSubject.getPrivateCredentials().clear();               
                sessionManager.destroySession(idpSession.getSessionID());
               
httpRequest.removeAttribute(Session.HTTP_SESSION_BINDING_ATTRIBUTE);

                // Reset the authn instant.
                if (actualAuthnInstant == null) {
                    actualAuthnInstant = new DateTime();
                }
            }

What I think this will do is to trash the existing session and
associated things. Then further down in the code where the
updateUserSession method is called it should create a new session from
the authenticated principle. Is that right? Am I clearing everything
about the user session? For background: I am integrating an application
that wishes to have absolutely no SSO due to running in a highly shared
environment (kiosk that is used by students during registration). I am
almost of the mind to setup another IdP to solve this problem, but I do
not have the time and resources to do that right now.

-- 
John P. Mitchell <jpmitchell at alaska.edu>
907.450.8320
http://www.alaska.edu/oit/iam

"All mankind is divided into three classes: those that are immovable,
those that are movable, and those that move." - Benjamin Franklin