force re-authentication.

[Nickles, Brent]

Good morning, we have an portal application that is successfully working with shib/SSO.    However, they want to bring up a sensitive 'resource' within the portal application and that they want to force a re-authentication.

Within the shibboleth2.xml file, we set forceAuthN="true" which is the new sensitive resource
<Path name="auth" authType="shibboleth" requireSession="true"/>
              <Path name="forcereauth" authType="shibboleth" requireSession="true" forceAuthn="true" />

Now, when coming from another shib application such as blackboard the forcereauth resource does indeed prompt for credentials, but if you first go into the auth resource, then the forcereauth resource it doesn't prompt for credentials.

My question is should the new resource be an additional SP and forceAuthN, or is there a way (or better practice) to use the existing SP and modify something to make this work?

Thanks everyone
Brent

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130826/c385a362/attachment.html