bypassing forceAuthn

[David Langenberg]

On Fri, Jan 27, 2012 at 2:02 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 1/27/12 3:54 PM, "David Langenberg" <davel at uchicago.edu> wrote:
>
> >I've noticed recently that an increasing number of SPs around my campus
> >are requiring forceAuthn in an attempt to take back control of the
> >user-auth/logout workflow.  The typical argument they make is "think of
> >the kiosk users".  Yeah Yeah, we've all had these same arguments with
> >vendors & SP admins at our own institutions.   However, being an IdP
> >admin and java developer who hates typing his password more than once per
> >day, I'd like to write some kind of extension or plugin which would
> >instruct the IdP to ignore any forceAuthn requests for a particular list
> >of users and just forge the response to make the SP think it got what it
> >asked for.
>
> Actually you might produce an instructive result by just telling the truth
> and see if they notice. The SP generates forceAuthn easily, but verifying
> the result is not automatic because it doesn't rely on signed requests.
> You have to enforce a delta to allow since the authentication time, and my
> guess is they aren't.
>
> That aside, it seems like the best way to approach it is with a checkbox
> on the login page in a custom login handler to create long-lived session
> or not at the IdP. That accomodates kiosks without playing tricks.
>

Yeah, the checkbox with cookie was one of my thoughts for generating the
bypass-forceAuthn flag.


>
> >Before i proceed to just blindly hack this into the IdP, I was wondering
> >if someone would give me a pointer of the best way to add this new
> >feature in a pluggable & maintainable way so I wouldn't need to keep a
> >set of diffs around.
>
> You need a custom login handler to do anything with the IdP that isn't
> trivial and has good error behavior for users. I can't imagine any better
> way to do what you're asking. There are no hooks into the forceAuthn flow
> other than the login handler. If you tell the IdP your handler supports
> forceAuthn, then that becomes a metter for the login handler to deal with.
>
>
Excellent, thanks Scott.

Dave

-- 
David Langenberg
Identity Management
The University of Chicago
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20120127/1709e904/attachment.html