Using Apache ShibRequestSetting authnContextClassRef and requesting new session

[Douglas E. Engert]

We have the IDP 2.3.5 configured to use the java-idp-x509-login-handler
to work with the login.jsp, as well as the x509-login.jsp.

On Ubuntu running the Ubuntu package: shiboleth-sp 2.3.1+dfsg-1build1
and the Apache directives listed below, I can do:

Without a session,  access /protected.test and be directed to the IDP
and use the login.jsp and authenticate using user/password or a smart card.

   With user/password SP reports:
     Shib-AuthnContext-Class=urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
   With smart card SP reports:
     Shib-AuthnContext-Class=urn:oasis:names:tc:SAML:2.0:ac:classes:X509

Without a session, access /protected.test.x509 and be directed to IDP
and use smart card using the x509-login.jsp and SP reports:
  Shib-AuthnContext-Class=urn:oasis:names:tc:SAML:2.0:ac:classes:X509
I can then access protected.test too.

So far so good.

But if I use user/password to authenticate first to access /protected.test
then try and access /protected.test.x509, I get an "Authentication Failed" page.

How can I get apache to request a new session using x509?


        <Directory /var/www/protected.test>
                 Options +Includes
                 AuthType shibboleth
                 ShibRequireSession On
                 ShibUseHeaders  Off
                 ShibExportAssertion On
                 ShibRequestSetting entityID https://xxxxx-lucid-vm1.it.anl.gov/idp/shibboleth
                 require valid-user
         </Directory>

         <Directory /var/www/protected.test.x509>
                 Options +Includes
                 AuthType shibboleth
                 ShibRequireSession On
                 ShibUseHeaders  Off
                 ShibExportAssertion On
                 ShibRequestSetting entityID https://xxxxx-lucid-vm1.it.anl.gov/idp/shibboleth
                 ShibRequestSetting authnContextClassRef urn:oasis:names:tc:SAML:2.0:ac:classes:X509
                 require authnContextClassRef urn:oasis:names:tc:SAML:2.0:ac:classes:X509
         </Directory>

-- 

  Douglas E. Engert  <DEEngert at anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444