Forced Authn and IdPUnsolicitedSSO

[Eric Goodman]

I may be stating the obvious, but the only way you can really enforce the forcedauthn is if the SP actually checks the resultant assertion for how old it is.

Shib SPs do that with the maxTimeSinceAuthn setting. However, given that you require IdP-initiated SSO, it's a good bet that you're not actually using a Shib SP, so who knows what the vendor has as a capability.

I'll also note that checking the time since authn presumes that the IdP sensibly sets the authnInstant in the assertion, which depending on how authentication is done is not always a valid assumption, but that is probably something you have more control over.

None of this affects your original question of how you create the assertion, just whether or not it's possible for people to bypass your attempt to enforce forcedauthn.

--- Eric

From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Mike Wiseman
Sent: Monday, August 04, 2014 1:28 PM
To: users at shibboleth.net
Subject: Forced Authn and IdPUnsolicitedSSO

Hi,

We are working on integrating an IBM DataPower appliance with our websso environment (which is shib idp 2.3.8). The plan is to use IdPUnsolicitedSSO since the DataPower, from my knowledge at the moment, does not support  generating SAML requests. There is a requirement to support forced authn though. Is it possible, besides via the SAML request, to force authn at the idp via the idpunsolicitedsso transaction?

Thanks,

Mike
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140805/8d6a1160/attachment.html