random Subject after removing PreviousSessionLoginHandler

[Cantor, Scott]

On 1/10/13 9:35 AM, "Burchhart Markus DEA sIT"
<Markus.Burchhart at s-itsolutions.at> wrote:
>
>Reason (Shibboleth 2.3.8):
>AuthenticationEngine:747 contains a method mergeSubjects(...) which joins
>together the old and new subject in a HashSet.
>As mergeSubjects(...) is a documented method, it dont seems like a bug by
>accident.
>
>Question 1:
>Is reauthentication against Shibboleth-IDP stable without
>PreviousSessionLoginHandler?
>How can I ensure that the old session is destroy when relogin is
>successful?

It's not supported at all, it never has been. The previous session handler
has nothing to do with that aspect of the system, that controls SSO, not
overall session behavior in terms of tracking principals associated with
the session.

There was an extensive design conversation back in 2010 about how to
change that in the next version and some discussion about it in Jira. It's
a hard problem to address since there is no way to know if a
reauthentication is meant to be the same user or not, and the fact that
different methods can express a subject name in different ways. What the
system does is always assume that it's one user, and tracks all the
principals, and the resolver has to sort that out.

>Question 2:
>How can I deactivate the SSO on per SP-basis?

Deactivating SSO is easy, but the only way to support reauthentication is
to stop tracking the user session at all by making it very short lived.
Otherwise, if a session exists, you get a merge.

This is one of the major reasons we agreed to produce an IdP-only logout
handler. It's not really about logout, but about controlling session
termination at the IdP, because of this ambiguity.

-- Scott