Query on ECP implementation

[GOSWAMI, Shivanggiri (Contractor)]

Hi Scott,

Thanks a lot..!

I authenticated a user using ECP and got the response back, then i made another AuthnRequest for the same user this time with the NameId returned in the earlier AuthnResponse and without the authorization header. I get the refreshed attributes, exactly what i want. Now if i have 2 active user sessions and i try to get the refreshed attributes with the nameid, i get an unexpected error with the log "A non-proceed event occurred while processing the request: InvalidSubjectContext". It is fetching the principal from the last authenticated session. It seems like idp only maintains single session, that of the last authenticated user. Please refer last 7 lines in the logs below.

I read the following on shibboleth wiki about session configuration. which i think means  session is stored against authentication flow id, which in my case will be same every time.
"The IdP session stores authentication results keyed on the ID of the authentication flow that drives the authentication process. The consequence of this design is that a subsequent invocation of the same authentication flow, for example in response to a forced authentication request, would overwrite a previous result of the same flow."

So how can i maintain different IDP session for differrent users ? Is  there a way to map session against principal name?

Following are my logs:
================
DEBUG [net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:168] - Attempting to match format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'
DEBUG [net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:186] - NameIDCanonicalizationFlowDescriptor c14n/SAML2Transient: format matches urn:oasis:names:tc:SAML:2.0:nameid-format:transient
DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] - Profile Action SelectSubjectCanonicalizationFlow: Selecting canonicalization flow c14n/SAML2Transient
DEBUG [net.shibboleth.idp.saml.nameid.impl.BaseTransientDecoder:122] - Transient Decoder 'net.shibboleth.idp.saml.nameid.impl.TransientNameIDDecoder#57a22fe6': using the store 'shibboleth.StorageService'
DEBUG [net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:168] - Attempting to match format 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient'
DEBUG [net.shibboleth.idp.saml.nameid.impl.NameIDCanonicalization$ActivationCondition:186] - NameIDCanonicalizationFlowDescriptor c14n/SAML2Transient: format matches urn:oasis:names:tc:SAML:2.0:nameid-format:transient
DEBUG [org.opensaml.saml.common.profile.impl.VerifyChannelBindings:154] - Profile Action VerifyChannelBindings: No channel bindings found to verify, nothing to do
DEBUG [org.opensaml.saml.saml2.profile.impl.PopulateECPContext:149] - Profile Action PopulateECPContext: RequestAuthenticated: false
DEBUG [org.opensaml.saml.saml2.profile.impl.PopulateECPContext:167] - Profile Action PopulateECPContext: Assertion encryption is not enabled, skipping session key generation
DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeAuthenticationContext:115] - Profile Action InitializeAuthenticationContext: Created authentication context: AuthenticationContext{initiationInstant=2017-12-18T15:24:28.284+05:30, isPassive=false, forceAuthn=false, hintedName=null, potentialFlows=[], activeResults=[], attemptedFlow=null, signaledFlowId=null, authenticationStateMap={}, resultCacheable=true, initialAuthenticationResult=null, authenticationResult=null, completionInstant=1970-01-01T05:30:00.000+05:30}
DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ProcessRequestedAuthnContext:174] - Profile Action ProcessRequestedAuthnContext: AuthnRequest did not contain a RequestedAuthnContext, nothing to do
DEBUG [net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:200] - Profile Action PopulateAuthenticationContext: Installed 1 potential authentication flows into AuthenticationContext
DEBUG [net.shibboleth.idp.session.impl.StorageBackedSessionManager:798] - Performing primary lookup on session ID 6ee1b980bc0f98cbc5ba6013331f0ed75e9c122042a1ab3c6f9ad191bfd7d8b4
DEBUG [net.shibboleth.idp.session.impl.StorageBackedIdPSession:90] - Updating expiration of master record for session 6ee1b980bc0f98cbc5ba6013331f0ed75e9c122042a1ab3c6f9ad191bfd7d8b4 to 2017-12-18T16:24:28.287+05:30
DEBUG [net.shibboleth.idp.session.impl.StorageBackedIdPSession:536] - Loading AuthenticationResult for flow authn/Password in session 6ee1b980bc0f98cbc5ba6013331f0ed75e9c122042a1ab3c6f9ad191bfd7d8b4
DEBUG [net.shibboleth.idp.session.impl.ExtractActiveAuthenticationResults:124] - Profile Action ExtractActiveAuthenticationResults: Authentication result authn/Password is active, copying from session
 DEBUG [net.shibboleth.idp.authn.impl.InitializeRequestedPrincipalContext:152] - Profile Action InitializeRequestedPrincipalContext: Profile configuration did not supply any default authentication methods
 DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:53] - Profile Action FilterFlowsByForcedAuthn: Request does not have forced authentication requirement, nothing to do
 DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByNonBrowserSupport:72] - Profile Action FilterFlowsByNonBrowserSupport: Retaining flow authn/Password, it supports non-browser authentication
 DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByNonBrowserSupport:84] - Profile Action FilterFlowsByNonBrowserSupport: Potential authentication flows left after filtering: {authn/Password=AuthenticationFlowDescriptor{flowId=authn/Password, supportsPassive=true, supportsForcedAuthentication=true, lifetime=600000, inactivityTimeout=300000}}
 DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:255] - Profile Action SelectAuthenticationFlow: No specific Principals requested
 DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:354] - Profile Action SelectAuthenticationFlow: Reusing active result authn/Password
 DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:144] - Profile Action FinalizeAuthentication: Canonical principal name established from session as 'user_dec_17_1'
 DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:186] - Profile Action FinalizeAuthentication: Request did not have explicit authentication requirements, result is accepted
 WARN [net.shibboleth.idp.authn.impl.FinalizeAuthentication:203] - Profile Action FinalizeAuthentication: Result of authentication (user_dec_17_1) does not match existing subject in context (user_dec_17_2)
 WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: InvalidSubjectContext
 DEBUG [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:184] - Error event InvalidSubjectContext will be handled with response

Thank you for your time..!!

Thanks,
Shivang
________________________________________
From: dev [dev-bounces at shibboleth.net] on behalf of Cantor, Scott [cantor.2 at osu.edu]
Sent: Tuesday, December 19, 2017 1:23 AM
To: Shib Dev
Subject: RE: Query on ECP  implementation

> 1). How is the session managed with ECP?

Sessions in ECP are somewhat loose since the client ultimately can authenticate autonomously, but if you were to handle cookies the IdP would issue them and use them in a fairly standard fashion, I believe.

> i see a property
> idp.session.StorageService = shibboleth.StorageService in idp.properties file.
> do i need to uncomment it to enable idp server side session management
> which perhaps will store session identifier on some file at IDP.

If you had the local-storage option turned off, the cookie-based client session service would work with it.

> 2). How can i get the refreshed attributes after some time ?  Will i have to
> perform AuthnRequest again, coz to me it seems it will create a new IDP
> session every time. Will the AttributeQuery work here, passing the nameid
> returned in the AuthnResponse ?

SAML SSO flows are time of authentication and there is no "refresh" notion built in.

-- Scott


--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net

Oxford University Press (UK) Disclaimer

This message is confidential. You should not copy it or disclose its contents to anyone. You may use and apply the information for the intended purpose only. OUP does not accept legal responsibility for the contents of this message. Any views or opinions presented are those of the author only and not of OUP. If this email has come to you in error, please delete it, along with any attachments. Please note that OUP may intercept incoming and outgoing email communications.