Configuring IdP v.2.3.8 with Silver assurance

[Terry Fleury]

On 9/26/2012 3:31 PM, Tom Scavo wrote:
> On Wed, Sep 26, 2012 at 4:23 PM, Terry Fleury <tfleury at illinois.edu> wrote:
>> I decided to bite the bullet and try to get Silver assurance working
>> with Shibboleth Idp v.2.3.8. I managed to get it working for my
>> particular use case: UC2: SP Prefers Silver in
>> https://spaces.internet2.edu/display/InCAssurance/SP+Assurance+Policy+Use+Cases
> Great!
>
>> This seems to work how I want it. When my test SP requests silver, the
>> IdP returns silver. When the SP requests nothing in particular, the IdP
>> returns PasswordProtectedTransport. In either case, the IdP presents the
>> user with the Username/Password login page. The login is authenticated
>> via Kerberos as configured in the login.config file.
>>
>> I'm not sure this is the _correct_ way to do this, but this method was
>> done via configuration alone (rather than writing custom login handler),
>> so at least it was easy to implement.
> In practice this would be useful if ALL users and ALL authentications
> in the IdP's security domain are equivalent. That probably won't turn
> out to be the case very often but who knows. If the assumption is
> true, however, why not just return silver in ALL cases (or I should
> say, in both cases: silver and unspecified)?

Returning silver for both cases (1. SP requests Silver and 2. SP 
requests nothing special) is very simple. In that case, one would only 
need to add the <init-param> section to the existing Username/Password 
section in web.xml, and then change the <AuthenticationMethod> in 
handler.xml from PasswordProtectedTransport to 
http://id.incommon.org/assurance/silver. This was the first thing I 
manage to get working during my tests. In this case, you are simply 
changing the authentication method returned by the UsernamePassword 
LoginHandler. From what I understand, the UsernamePassword LoginHandler 
can return only one authenticationmethod, the default is 
PasswordProtectedTransport. The <init-param> section can change the 
method returned.

The particular use case I quoted was specific to the SP. But I wanted a 
corresponding setup on the IdP side. In other words, if the IdP was 
prompted to give silver, then give silver. If the Idp was NOT prompted 
to give silver, then give the default PasswordProtectedTransport.

In my time on the InCommon assurance calls, I always took the point of 
view of the SP. This is the first time I've worked on the IdP side. I 
admit that I haven't considered the various use cases for the IdP, and I 
certainly don't claim to have expert knowledge of how IdPs work. I guess 
this was just more of an exercise to see if I could get shib idp v.2.3.x 
to behave how I had configured my test idp v.2.2.1.

Terry