force re-authentication.

[Cantor, Scott]

On 8/26/13 10:06 AM, "Nickles, Brent" <bnick001 at umaryland.edu> wrote:

>Within the shibboleth2.xml file, we set forceAuthN=²true² which is the
>new sensitive resource
><Path name="auth" authType="shibboleth" requireSession="true"/>
>              <Path name="forcereauth" authType="shibboleth"
>requireSession="true" forceAuthn="true" />

That's fine but it isn't sufficient to mean anything, they have to enforce
access policy locally on the allowed time since authentication. I've
addressed this on the list numerous times, it's in the archives.

> 
>Now, when coming from another shib application such as blackboard the
>forcereauth resource does indeed prompt for credentials, but if you first
>go into the auth resource, then the forcereauth resource it doesn¹t
>prompt for credentials.

ForceAuthn only applies to new sessions.

> 
>My question is should the new resource be an additional SP and
>forceAuthN, or is there a way (or better practice) to use the existing SP
>and modify something to make this work?

The best practice is not to do this, but if you must, you would need to
create an ApplicationOverride for the subset of resources involved if you
want to isolate the session behavior from the rest of the system. Usually
with a path-based override in this kind of case, whch is described in the
wiki, and it's quite complex to do this, involving lots of additional XML
config and additional metadata for the new endpoints that have to live in
the overridden path.

-- Scott