Need help with the Shibboleth SP configuration

[Peter Schober]

* anandan <anupam.nandan at gmail.com> [2014-07-07 19:07]:
> Last time, I was able to change the "Access Denied" to the custom message.
> However, I still need to kill the Shibboleth session. It seems to me that
> <Errors access="yourTemplate.html" /> has only option for static page as it
> doesn't run aspx. Moreover I don't see any thing happening on the fiddler. 

What did you expect to see? The template will just display the content
of your chosing to the user agent.

> 1. Is there any way I can make the user to force re authenticate
> with IDP, if user is trying to access web page which need higher
> authentication?

While you can certainly send a redirect to the user agent to initiate
a (new) session with your SP using a given IDP, there would need to be
something different in the authnRequest (commonly a specific auth
context) to signal to the IDP to behave differently. Otherwise the
subject would return with the same data as before, due to SSO.

> 2. Can I add java script in "yourTemplate.html" and get the Shibboleth SP
> session handle in order to kill it ?
> Any small sample or pointer would be helpful. 

You could simply remove (i.e. overwrite and set expirey to a past
date) HTTP cookies set by the SP, e.g. by iterating over all available
cookies.
-peter