Configuring IdP v.2.3.8 with Silver assurance

[Terry Fleury]

I decided to bite the bullet and try to get Silver assurance working 
with Shibboleth Idp v.2.3.8. I managed to get it working for my 
particular use case: UC2: SP Prefers Silver in 
https://spaces.internet2.edu/display/InCAssurance/SP+Assurance+Policy+Use+Cases 
.

Basically, the SP first requests silver assurance. My SP does this by 
passing "authnContextClassRef=http://id.incommon.org/assurance/silver" 
to the login handler. If the IdP returns an error message (meaning that 
it doesn't support silver), then the SP tries a second time, but this 
time without the "authnContextClassRef" parameter.

On the IdP side, I had to make two configuration changes.

First, in web.xml (found in idp.war at WEB-INF/web.xml), I duplicated 
the section commented as "<!-- Servlet for doing Username/Password 
authentication -->", and modified it slightly. The copied section looks 
like this:

     <!-- Servlet for doing Username/Password Silver authentication -->
     <servlet>
<servlet-name>UsernamePasswordSilverAuthHandler</servlet-name>
<servlet-class>edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet</servlet-class>
         <load-on-startup>3</load-on-startup>
         <init-param>
           <param-name>authnMethod</param-name>
<param-value>http://id.incommon.org/assurance/silver</param-value>
         </init-param>
     </servlet>

     <servlet-mapping>
<servlet-name>UsernamePasswordSilverAuthHandler</servlet-name>
<url-pattern>/Authn/UserPasswordSilver</url-pattern>
     </servlet-mapping>

As you can see, I changed the <servlet-name> (in two places) and the 
<url-pattern>, adding the word "Silver". Also, I added an <init-param> 
section to return silver assurance by default.

Second, in conf/handler.xml, I uncommented the UsernamePassword 
LoginHandler, duplicated it, and modified the copy to match the new 
section in web.xml. The new section in handler.xml looks like this:

     <!--  Username/password Silver login handler -->
     <ph:LoginHandler xsi:type="ph:UsernamePassword"
jaasConfigurationLocation="file:///opt/shibboleth-idp/conf/login.config"
authenticationServletURL="/Authn/UserPasswordSilver">
<ph:AuthenticationMethod>http://id.incommon.org/assurance/silver</ph:AuthenticationMethod>
     </ph:LoginHandler>

Here I had to make two changes. First, I added the 
"authenticationServletURL" parameter to match the <url-pattern> entry in 
the web.xml file. Second, I set the AuthenticationMethod to silver to 
match the <init-param> section in the web.xml.

This seems to work how I want it. When my test SP requests silver, the 
IdP returns silver. When the SP requests nothing in particular, the IdP 
returns PasswordProtectedTransport. In either case, the IdP presents the 
user with the Username/Password login page. The login is authenticated 
via Kerberos as configured in the login.config file.

I'm not sure this is the _correct_ way to do this, but this method was 
done via configuration alone (rather than writing custom login handler), 
so at least it was easy to implement.

Terry Fleury
tfleury at illiinois.edu