Modify forceAuthn Authentication Engine Behavior

[John Mitchell]

Scott,

On 12/15/2011 03:27 PM, Cantor, Scott wrote:
> On 12/16/11 12:50 AM, "Chad La Joie" <lajoie at itumi.biz> wrote:
>> But again, the only actual solution is to either require
>> authentication for every single request or educate the user so they
>> don't do dumb things.
> That would be true if there was anything the user could do to actually
> terminate the IdP session, but that isn't generally feasible with modern
> browsers and the typical kiosk.
>

    Thanks Scott. You said very succinctly what I was trying to say in
too many words I guess.

> I don't think forceAuthn is implemented incorrectly, and I would say that
> the AuthnContext solution is probably the right one. But that only works
> if you can react to the error at the IdP that blocks principal switching
> with some user action, and I can't think what that would be at the moment.

    I think forceAuthn is fine, it was just a convenient place to change
that would get the behavior I want.

    A new login handler/AuthnContext was one of my initial thoughts but
it would seem if I wrote a login handler that the login handler would
still have to destroy the existing session. Is that right? Would that
action of destroying the session be crossing any API boundaries? Seems
like it would to me.

    Also it struck me last night that if it was possible to have a
AuthnContext solution that would skip the previous session login handler
that I might get something like I want. Is that true, or would I end up
with the same behavior as forceAuthn where the IdP expects the same
principal? Seems like I could also end up with alot of orphan sessions
lying around in the IdP as well.

> -- Scott
>
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net


-- 
John P. Mitchell <jpmitchell at alaska.edu>
907.450.8320
http://www.alaska.edu/oit/iam

"All mankind is divided into three classes: those that are immovable,
those that are movable, and those that move." - Benjamin Franklin