AW: nameID mixup in IDP session

[Gruber Bernhard SAI sIT]

We currently use the ExternalAuthn login handler which forwards to our Servlet with actually does the Authentication.

What is the basic idea how to bypass the IDP-session?
I have problems finding your code on the contributions page.
On https://wiki.shibboleth.net/confluence/display/SHIB2/Contributions
I find no login handler with your email in the "Maintainer Contact Info." column.


-----Ursprüngliche Nachricht-----
Von: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] Im Auftrag von Cantor, Scott
Gesendet: Freitag, 31. Mai 2013 16:32
An: Shib Users
Betreff: RE: nameID mixup in IDP session [ccs][heur]

> The mixup is done in AuthenticationEngine.mergeSubjects() which puts
> together both principals in one subject
> and  AbstractSAML2ProfileHandler. populateUserInformation() which takes
> out the name of the first principal from the subject.
> The subject stores the principals in a HashSet with undefined order by
> design.

Yes.

> By the way, the LoginContext contains the correct user information in its
> authenticationMethodInformation.

Yes, because it's transactional, not session-oriented. There's no history there.

> Is there a known secure way to use SSO and more than one authentication
> method?

I think it has more to do with multiple *users* than methods, but the basic answer is, write your own login handler as a super-structure for your own logic and bypass the existing SSO semantics and session behavior. I did a good deal of that in my own code, which is available from the contributions page.
 
The V3 design is explicitly fixing all of this by requiring every method to produce a canonical principal name that will enable configurable behavior for user switching events. This is probably my highest priority design issue.

-- Scott


--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net