bypassing forceAuthn

[David Chadwick]

David

you need to consider the trust implications of what you are suggesting. 
SPs trust IdPs to do user authentication according to their requests. If 
you intend to get your IdP to effectively lie to the SP, then you become 
an untrustworthy IdP. Is this really what you are proposing?

regards

David

On 27/01/2012 20:54, David Langenberg wrote:
> Hi Devs,
>
> I've noticed recently that an increasing number of SPs around my campus
> are requiring forceAuthn in an attempt to take back control of the
> user-auth/logout workflow.  The typical argument they make is "think of
> the kiosk users".  Yeah Yeah, we've all had these same arguments with
> vendors & SP admins at our own institutions.   However, being an IdP
> admin and java developer who hates typing his password more than once
> per day, I'd like to write some kind of extension or plugin which would
> instruct the IdP to ignore any forceAuthn requests for a particular list
> of users and just forge the response to make the SP think it got what it
> asked for.
>
> Before i proceed to just blindly hack this into the IdP, I was wondering
> if someone would give me a pointer of the best way to add this new
> feature in a pluggable & maintainable way so I wouldn't need to keep a
> set of diffs around.
>
> Thanks
>
> Dave
>
> --
> David Langenberg
> Identity Management
> The University of Chicago
>
>
>
> --
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net

-- 

*****************************************************************
David W. Chadwick, BSc PhD
Professor of Information Systems Security
School of Computing, University of Kent, Canterbury, CT2 7NF
Skype Name: davidwchadwick
Tel: +44 1227 82 3221
Fax +44 1227 762 811
Mobile: +44 77 96 44 7184
Email: D.W.Chadwick at kent.ac.uk
Home Page: http://www.cs.kent.ac.uk/people/staff/dwc8/index.html
Research Web site: http://www.cs.kent.ac.uk/research/groups/iss/index.html
Entrust key validation string: MLJ9-DU5T-HV8J
PGP Key ID is 0xBC238DE5

*****************************************************************