Switching the user in the same SSO session

[Manuel Haim]

Hi Kotesh,

> On 8/15/13 11:21 AM, "Douglas E. Engert" <deengert at anl.gov> wrote:
>>
>> Could you have the SP force re-authentication for the transaction?
>>
>> https://wiki.cac.washington.edu/display/infra/Configure+a+Service+Provider
>> +to+Force+Re-Authentication

you may use our custom login handler in this case:
http://www.staff.uni-marburg.de/~haimm/unimr-login.shib2.2011_11_21.zip

It is a combination of the default UsernamePassword login handler and
the SSO login handler with the following additions:

a) When doing forceAuthn, you can login under a different name (the
previous login is destroyed).
b) For kiosk machines (detected by IP address), it shows an additional
"Guest login" button.
c) The IP address of the user is added to the session's
publicCredentials (for use in attribute resolution, but please take care
of this Security Advisory:
http://shibboleth.internet2.edu/secadv/secadv_20110718.txt).
d) The user can deactivate SSO when he logs in (this is done by
combining the PreviousSession and UsernamePassword login handler to just
one login handler which handles both). This way, the user will be asked
to log in again for each SP. This option may also train our current
users to understand what SSO means (as by now, without Shibboleth, they
still need to log in to each single web application).
e) As we have multiple user bases, the user can choose the domain he
belongs to when logging in (e.g. "staff" or "students").


-Manuel