Forced Authentication

[Peter Schober]

* Peter Schober <peter.schober at univie.ac.at> [2014-01-21 20:07]:
> * krrishv <krish.v at gmail.com> [2014-01-21 19:42]:
> > I use username/password login handler. But Once i login to the session, If i
> > open another tab and re-enter the same login URL. I want it to ask force for
> > authentication. If i can configure this in login/password handler. What do i
> > need to add to the configuration.
> 
> You don't. You are not even testing forcedAuthn as you're not
> involving the IdP at all in the above scenario: As long as there is a
> valid session at the SP it will not send the user agent to the IdP on
> each and every request (that would be pretty annoying and
> pointless).

Maybe your misunderstanding is in what "another tab" means, then my
explanation above is oversimplfied: Unless you're using "private mode"
or something like that in your user agent (and neither Chromium nor
Firefox does this in a tab) opening a tab means the tab will share
state, including HTTP Cookies, with all other open tabs.
Since requests to the SP made feom the new tab will include HTTP
Cookies set by the SP the SP will find a matching session in is
Storage Service and hence the new tab will be "logged in" just as any
other tab in that same browser was.

Opening a new window in "private browsing" mode (or another user agent
altogether) on the other hand will also not demonstrate forcedAuthn
properly, as then you won't have an SSO session at the IdP to begin
with which forcedAuthn would tell the IdP to ignore.

Only by removing the valid session at the SP (e.g. by restarting shibd
on the SP, or by removing its representation in the user agent,
i.e. the matching HTTP Cookie) you'll see forcedAuthn in action.
-peter