Need help with the Shibboleth SP configuration

[Cantor, Scott]

On 7/7/14, 1:07 PM, "anandan" <anupam.nandan at gmail.com> wrote:
>
>Last time, I was able to change the "Access Denied" to the custom message.
>However, I still need to kill the Shibboleth session. It seems to me that
><Errors access="yourTemplate.html" /> has only option for static page as
>it
>doesn't run aspx. Moreover I don't see any thing happening on the fiddler.

It is static. If you want to build links to the necessary handlers or
invoke them automatically with Javascript or a meta-refresh, then you
might be able to do something useful. Or not.

>1. Is there any way I can make the user to force re authenticate with IDP,
>if user is trying to access web page which need higher authentication?

You can split the content into separate application overrides, as I
originally suggested you would have to do. Otherwise no, not explicitly.

>2. Can I add java script in "yourTemplate.html" and get the Shibboleth SP
>session handle in order to kill it ?

Probably.

>Any small sample or pointer would be helpful.

I don't have any Javascript to give you. If you want to kill the local
session, you use /Shibboleth.sso/Logout, but I don't think the session is
the issue, you propbably need to just point to the initiator at /Login
with the parameters you want to add to get it to request a different
authnContextClassRef.

So the page can say "here's why you can't get in, if you want to get in,
click here".

-- Scott