Force SP to require login each time?

[Cantor, Scott]

On 6/21/13 12:01 PM, "David Hodnett" <david at pathbrite.com> wrote:
>
>The short version: we are a service provider and we'd like to force
>anyone to connecting to us, to authenticate against their IdP each and
>every time. We are using Shibboleth 2.4.3. Is this possible?

See the forceAuthn and maxTimeSinceAuthn settings. Whether it's possible
is up to the IdP. It's not possible unless you limit support to SAML 2.0
only, and then you have to rely on the IdP doing it correctly. Correctly
may mean returning an error because it isn't capable of honoring the
request.

>We've discovered is that if they log out of our service and someone else
>comes along and sits down at the same machine, the Shibboleth session is
>still active and the new visitor can access the old user's files.

You're never going to fix that problem from your end, unfortunately.

>Defining a <Logout> element informs us that the local plugin type is
>unknown. If we change that to a <LogoutInitiator> there's no protocol or
>binding for the local protocol.

Probably because it's "Local", not "local". But that's not going to help
you. That has no impact on the IdP session.

>We've tried setting the session timeout to 1 second as inŠ

The SP session and the IdP session are not related.

>And we've tried setting the forceAuthn parameter in the <SSO>. When that
>didn't work, we replaced the <SSO> with a <SessionInitiator> to no avail.

That is the answer. "Didn't work" is a non-specific description, but for
starters, that is a SAML 2.0 feature only. If you send the option to a
SAML 2.0 IdP then it will either work or the IdP will return an error or
the IdP has a configuration problem.

Of course this is a subjective setting. A client that caches passwords can
still auto-sign-in a user to an IdP that is "honoring" forceAuthn. You can
do everything correctly and it will have no effect on the apparent
experience.

It's also not sufficient. The SP requires enforcement at login time, it
does not have a way to remember that forceAuthn was used. If you really
care, you have to set maxTimeSinceAuthn or do application-level checking
of the time of login at the IdP. And you have to trust the IdP is setting
that time correctly.

-- Scott