FW: force re-authentication.

[Manuel Haim]

Hi Brent,

please send your answers to users at shibboleth.net , so they may appear on
the mailing list (not just to me).


I guess you need to put the forceAuthn attribute into the
SessionInitiator (not just the path), there's a good description at
https://wiki.cac.washington.edu/display/infra/Configure+a+Service+Provider+to+Force+Re-Authentication


--- quote ---

If your application uses the <SSO> element within <ApplicationDefaults>:
<SSO entityID="urn:mace:incommon:washington.edu" forceAuthn="true">
     SAML2 SAML1
</SSO>


If your application uses a <SessionInitiator> element within
<ApplicationDefaults>:
<SessionInitiator type="Chaining" Location="/Login" isDefault="true"
id="Login"
     entityID="urn:mace:incommon:washington.edu" forceAuthn="true">
</SessionInitiator>


If you have configured an application override for you application and
want forced re-authentication to affect only this application and not
other applications on the same web site, you would make the change to
the <SessionInitiator> element within the <ApplicationOverride> element
rather than within the <ApplicationDefaults> element.

--- end of quote ---


What does your Apache configuration look like? Did you protect only the
"auth" path, or also the "forcereauth"? There should be multiple entries
also in your Apache config, like these:

  <Location /auth>
    AuthType shibboleth
    ShibRequireSession On
    require shibboleth
  </Location>

  <Location /forcereauth>
    AuthType shibboleth
    ShibRequireSession On
    require shibboleth
  </Location>



Also make sure that forceauthn only works with SAML2, so if you still
have a Shibboleth IdP 1.x (speaking only SAML1) it won't work.

-Manuel



Am 11.09.2013 17:10, schrieb Nickles, Brent:
> Manuel, Yes, the SP and web server were restarted.    I'm missing something here, just not sure what:
> 
> Key points of Shib2.xml file:
> -<Host name="webdev.rx.umaryland.edu"><Path name="auth" requireSession="true" authType="shibboleth"/>
> 	<Path name="forcereauth" requireSession="true" authType="shibboleth" forceAuthn="true"/></Host>
> <Sessions lifetime="28800" timeout="3600" relayState="ss:mem"
>                   checkAddress="false" handlerSSL="false" cookieProps="http" maxTimeSinceAuthn="30">
> 
> 
> Thanks again.
> 
> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Manuel Haim
> Sent: Thursday, August 29, 2013 10:53 AM
> To: users at shibboleth.net
> Subject: Re: force re-authentication.
> 
> Hi Brent,
> 
> did you restart the SP (shibd) and Apache after configuration change?
> 
> The maxTimeSinceAuthn option should tell the SP that, if the last IdP authentication was done more than e.g. 30 seconds ago, the user shall re-authenticate at the IdP.
> 
> If you test this, please keep in mind that at least 30 seconds have to pass from your initial login till trying the "forced" authentication.
> (If not using an <ApplicationOverride> containing another <Sessions> element, all shib-protected resources run under the same SP session.)
> 
> 
> -Manuel
> 
> 
> Am 29.08.2013 16:12, schrieb Nickles, Brent:
>> Manuel, thanks for the reply.
>> The owner of the SP put this in the shibboleth2.xml file; however
>> the results are the same.   Any other ideas to force re-authN?
>>
>> Thanks
>> Brent
>>
>> -----Original Message-----
>> From: users-bounces at shibboleth.net
> [mailto:users-bounces at shibboleth.net] On Behalf Of Manuel Haim
>> Sent: Monday, August 26, 2013 10:56 AM
>> To: users at shibboleth.net
>> Subject: Re: force re-authentication.
>>
>> Hi Brent,
>>
>> Am 26.08.2013 16:06, schrieb Nickles, Brent:
>>> but if you first go into the auth resource, then the forcereauth 
>>> resource it doesn't prompt for credentials
>>
>> you also need to set maxTimeSinceAuthn in your <Sessions> node in
> order to make this work as expected (but not too low, e.g. to 30 seconds).
>>
>> -Manuel
>> --
>> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>>
> 
> 
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>