Force SP to require login each time?

[David Hodnett]

Hello,

The short version: we are a service provider and we'd like to force anyone to connecting to us, to authenticate against their IdP each and every time. We are using Shibboleth 2.4.3. Is this possible? 

The longer version: we've developed a social/educational web site with various options to import data from various sources. One of those sources is a cloud storage resource (like Google Drive) where access is controlled via Shibboleth. Our users can successfully authenticate and retrieve whatever they need. We've discovered is that if they log out of our service and someone else comes along and sits down at the same machine, the Shibboleth session is still active and the new visitor can access the old user's files.

We'd like to force a logout but according to https://wiki.shibboleth.net/confluence/display/SHIB2/SLOIssues, it's not trivial.

Defining a <Logout> element informs us that the local plugin type is unknown. If we change that to a <LogoutInitiator> there's no protocol or binding for the local protocol. 

The other option we're looking at is, whenever the user clicks the import button, we'd like to force them to log into the service again.

We've tried setting the session timeout to 1 second as in…

 <Sessions lifetime="1" timeout="1" cookieLifetime="1" checkAddress="false" relayState="ss:mem" handlerSSL="false">

And we've tried setting the forceAuthn parameter in the <SSO>. When that didn't work, we replaced the <SSO> with a <SessionInitiator> to no avail. 

I suspect we're missing something obvious but the way the wiki is set up, it's hard to find something when you don't know what you're looking for.  :)  Will someone please point us in the right direction?

Thanks,

David Hodnett
david at pathbrite.com
www.pathbrite.com
@pathbrite