Enforce re-authenticate user

[Cantor, Scott]

On 2/17/14, 9:42 AM, "Raadush" <raadush at gmail.com> wrote:

>Authentication methods I talk about are inside this login hander and
>shibboleth doesn't know nothing about them right now. I think I should do
>something inside that redirect.jsp (like call my external jar and check
>what method was used for example from cookies or so) and then somehow
>redirect user either as authenticated or sanding new request like you
>suggested. But i dont know if this can be done and if so, how :)

Firstly, you should not be using "unspecified". Whatever methods you want
to support, just enumerate them so that they all dispatch to your handler.

Secondly, if you're doing it entirely within that handler, then you are
free to implement anything you want. If you want to handle ForceAuthn from
an SP, or evaluate comparative strength in methods, just do that. The
session with the user, which you have access to, contains the "active"
authentication methods.

Lastly, you could also use the PreviousSession handler to do SSO provided
the SP that wants a stronger method requests it.

-- Scott