bypassing forceAuthn

[Cantor, Scott]

On 1/27/12 3:54 PM, "David Langenberg" <davel at uchicago.edu> wrote:

>I've noticed recently that an increasing number of SPs around my campus
>are requiring forceAuthn in an attempt to take back control of the
>user-auth/logout workflow.  The typical argument they make is "think of
>the kiosk users".  Yeah Yeah, we've all had these same arguments with
>vendors & SP admins at our own institutions.   However, being an IdP
>admin and java developer who hates typing his password more than once per
>day, I'd like to write some kind of extension or plugin which would
>instruct the IdP to ignore any forceAuthn requests for a particular list
>of users and just forge the response to make the SP think it got what it
>asked for.  

Actually you might produce an instructive result by just telling the truth
and see if they notice. The SP generates forceAuthn easily, but verifying
the result is not automatic because it doesn't rely on signed requests.
You have to enforce a delta to allow since the authentication time, and my
guess is they aren't.

That aside, it seems like the best way to approach it is with a checkbox
on the login page in a custom login handler to create long-lived session
or not at the IdP. That accomodates kiosks without playing tricks.

>Before i proceed to just blindly hack this into the IdP, I was wondering
>if someone would give me a pointer of the best way to add this new
>feature in a pluggable & maintainable way so I wouldn't need to keep a
>set of diffs around.

You need a custom login handler to do anything with the IdP that isn't
trivial and has good error behavior for users. I can't imagine any better
way to do what you're asking. There are no hooks into the forceAuthn flow
other than the login handler. If you tell the IdP your handler supports
forceAuthn, then that becomes a metter for the login handler to deal with.

-- Scott