Enforce re-authenticate user

[Peter Schober]

* Raadush <raadush at gmail.com> [2014-02-17 15:10]:
> I want to change it to something like this:
> 
> user accesses SP1 -> he is redirected to my IDP -> authenticates using
> password -> SP1 accepts it
> user accesses SP2 -> he is redirecred to my IDP -> IDP checks if he used
> strong enough method when he authenticated himself at SP1 -> if he USED
> strong enough method, IDP authenticates him based on previous session like
> before, if he DIDNT used strong enough method, he is forced to
> re-authenticate

The Shib IDP reports the authentcation method used to any SP, so SP2
can check that and decide to do whatever it wants (e.g. using your own
code invoked from a sessionHook), such as sending a new authentication
request to the IDP requesting a specific authnContext (and/or
forcedAuthn).
For any advanced behaviour at the IDP not supported out of the box
you'd need a custom login handler. I'd start looking at and
contributing to the MCB one.
-peter