Implications of forceAuthn/AuthnInstant

[Michael A Grady]

On Oct 1, 2013, at 8:04 PM, Cantor, Scott wrote:

> On 10/1/13 8:43 PM, "Eric Goodman" <Eric.Goodman at ucop.edu> wrote:
>> 
>> 
>> The apps I¹m talking to effectively want a ³sudo² function for SSO, where
>> for some ³elevated privilege² operations (or SPs), they can force a
>> reauthentication, even though the authentication method isn¹t changing.
> 
> 
.....

>> I.e., if Shib relies on CAS for authentication, CAS can provide a
>> ³fresh² authentication to Shib without the user seeing any actual prompt
>> to re-enter credentials.
> 
> Yes, that means your login handler should not indicate support for
> ForceAuthn.
> 

There are several "recipes/methods" for having Shib rely on CAS for authentication. At least one of those methods, the Shibboleth IdP external authentication plugin (https://github.com/Unicon/shib-cas-authenticator) does have proper support for ForceAuthn (i.e. passing thru to CAS the "renew=true" parameter which is CAS's signal for forced authentication).

--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.