Modify forceAuthn Authentication Engine Behavior

[John Mitchell]

All,

On 12/14/2011 04:18 PM, John Mitchell wrote:
> All,
>
>     I would like to change the behavior of the authentication engine in
> the IdP when it comes to how it handles the forceAuthn attribute.
> Looking at the docs it does not appear that there is a way to extend or
> replace the authentication engine and I wish to leave the current login
> handlers and the IdP session length as it is. So I would like to make
> the following change to the completeAuthentication method in the
> AuthenticationEngine class:
>
> from:
>             if (loginContext.isForceAuthRequired()) {
>                 validateForcedReauthentication(idpSession,
> actualAuthnMethod, subject);
>
>                 // Reset the authn instant.
>                 if (actualAuthnInstant == null) {
>                     actualAuthnInstant = new DateTime();
>                 }
>             }
>
> to:
>             if (loginContext.isForceAuthRequired()) {
>                 Subject oldSubject = idpSession.getSubject();
>                 oldSubject.getPrincipals().clear();
>                 oldSubject.getPublicCredentials().clear();
>                 oldSubject.getPrivateCredentials().clear();               
>                 sessionManager.destroySession(idpSession.getSessionID());
>                
> httpRequest.removeAttribute(Session.HTTP_SESSION_BINDING_ATTRIBUTE);
>
>                 // Reset the authn instant.
>                 if (actualAuthnInstant == null) {
>                     actualAuthnInstant = new DateTime();
>                 }
>             }
>
> What I think this will do is to trash the existing session and
> associated things. Then further down in the code where the
> updateUserSession method is called it should create a new session from
> the authenticated principle. Is that right? Am I clearing everything
> about the user session? For background: I am integrating an application
> that wishes to have absolutely no SSO due to running in a highly shared
> environment (kiosk that is used by students during registration). I am
> almost of the mind to setup another IdP to solve this problem, but I do
> not have the time and resources to do that right now

    Any feedback on this? I will even take "Are you freaking crazy!?!?".
Just want to make sure technically this will remove all traces of the
previous session and generate a whole new session. I am aware this could
cause problems with SPs that assert isPassive but I do not believe I
have any SPs that are asserting that currently. I can see no other way
to solve this problem besides turning down the IdP's session length very
low or setting up another IdP for these kinds of SPs. Neither of those
approaches is appealing as it impacts every user that interacts with the
IdP instead of just the ones that use the kiosk app. Any input is
appreciated even flame.

-- 
John P. Mitchell <jpmitchell at alaska.edu>
907.450.8320
http://www.alaska.edu/oit/iam

"All mankind is divided into three classes: those that are immovable,
those that are movable, and those that move." - Benjamin Franklin