SP: updating attributes

[Cantor, Scott E.]

On 8/10/11 4:01 PM, "Yuji Shinozaki" <ys2n at virginia.edu> wrote:
>
>We are using the Native SP via mod_shib and have a need to make sure that
>the shibboleth attributes are updated with each visit to certain urls.

That isn't supported or on any road map. It's a completely different
internal design.

>It seems that with the native sp the only way to update the attributes is
>via an authentication.  So one way it seems that we can accomplish what
>we want is to reduce the <Session> lifetime to something very short, but
>that reduces the session lifetime for all of the shibboleth applications
>to which that <Session> applies.

A session only applies to one application by definition. You decide what
resources are grouped into an application.

>It would be preferable to able to say something to the effect of
>"re-validate the session when you go to these particular urls" or
>preferably "update the shib attributes when you go to these particular
>urls".

There is no such feature.

>Is there a better way to accomplish the behavior we would like?

Not separate from authentication. If you want to invalidate a session, you
can do that any time you like, without using forceAuthn, but you're still
sending the user back to the IdP for whatever will happen there.

-- Scott