Enforce re-authenticate user

[Raadush]

Thanks, but I dont think we uderstand each other. I use custom login
handler so auhentication method you talk about is always
    <ph:LoginHandler xsi:type="ph:ExternalAuthn"
                     externalAuthnPath="redirect.jsp"
                     supportsForcedAuthentication="true">

<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</ph:AuthenticationMethod>
    </ph:LoginHandler>

Authentication methods I talk about are inside this login hander and
shibboleth doesn't know nothing about them right now. I think I should do
something inside that redirect.jsp (like call my external jar and check
what method was used for example from cookies or so) and then somehow
redirect user either as authenticated or sanding new request like you
suggested. But i dont know if this can be done and if so, how :)


2014-02-17 15:30 GMT+01:00 Peter Schober <peter.schober at univie.ac.at>:

> * Raadush <raadush at gmail.com> [2014-02-17 15:10]:
> > I want to change it to something like this:
> >
> > user accesses SP1 -> he is redirected to my IDP -> authenticates using
> > password -> SP1 accepts it
> > user accesses SP2 -> he is redirecred to my IDP -> IDP checks if he used
> > strong enough method when he authenticated himself at SP1 -> if he USED
> > strong enough method, IDP authenticates him based on previous session
> like
> > before, if he DIDNT used strong enough method, he is forced to
> > re-authenticate
>
> The Shib IDP reports the authentcation method used to any SP, so SP2
> can check that and decide to do whatever it wants (e.g. using your own
> code invoked from a sessionHook), such as sending a new authentication
> request to the IDP requesting a specific authnContext (and/or
> forcedAuthn).
> For any advanced behaviour at the IDP not supported out of the box
> you'd need a custom login handler. I'd start looking at and
> contributing to the MCB one.
> -peter
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140217/ced880c9/attachment.html