Force SP to require login each time?

[Eric Goodman]

Use forceAuthn to force the login. (Not related to logout)

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPSessionCreationParameters

This asks the IdP to require a re-authentication with the authentication request, regardless of existing IdP sessions. Only available in SAML 2. In practice, if the IdP honors the request, this means that after logging out of your application and SP locally, the user is actually logged out. Note that sometimes the issues are that applications logout of the SP session, but not the application session or vice versa, though I'm guessing that's not the issue here.


The part where you want to force a re-authentication on a specific application action may be trickier. It looks like you would need force a new authentication event (send a new assertion request), then compare the AuthnInstant of the assertion to the time "import" button was pressed, or some such. (I see list and JIRA entries that address AuthnInstant, but not wiki docs for it).


Others may well correct my advice. :)

--- Eric


-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of David Hodnett
Sent: Friday, June 21, 2013 9:02 AM
To: users at shibboleth.net
Subject: Force SP to require login each time?

Hello,

The short version: we are a service provider and we'd like to force anyone to connecting to us, to authenticate against their IdP each and every time. We are using Shibboleth 2.4.3. Is this possible? 

The longer version: we've developed a social/educational web site with various options to import data from various sources. One of those sources is a cloud storage resource (like Google Drive) where access is controlled via Shibboleth. Our users can successfully authenticate and retrieve whatever they need. We've discovered is that if they log out of our service and someone else comes along and sits down at the same machine, the Shibboleth session is still active and the new visitor can access the old user's files.

We'd like to force a logout but according to https://wiki.shibboleth.net/confluence/display/SHIB2/SLOIssues, it's not trivial.

Defining a <Logout> element informs us that the local plugin type is unknown. If we change that to a <LogoutInitiator> there's no protocol or binding for the local protocol. 

The other option we're looking at is, whenever the user clicks the import button, we'd like to force them to log into the service again.

We've tried setting the session timeout to 1 second as in...

 <Sessions lifetime="1" timeout="1" cookieLifetime="1" checkAddress="false" relayState="ss:mem" handlerSSL="false">

And we've tried setting the forceAuthn parameter in the <SSO>. When that didn't work, we replaced the <SSO> with a <SessionInitiator> to no avail. 

I suspect we're missing something obvious but the way the wiki is set up, it's hard to find something when you don't know what you're looking for.  :)  Will someone please point us in the right direction?

Thanks,

David Hodnett
david at pathbrite.com
www.pathbrite.com
@pathbrite

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net