URL access given to Protected page by Shibboleth Service Provider

[anupam.nandan at gmail.com]

Hello Everyone 

I am a new user of Shibboleth and I successfully configured the Shibboleth
Service provider with SiteMinder IDP. Now I am seeing a strange problem. 

I have configured the two paths in the Shibboleth2.xml which has different
access levels for the same website hosted on the IIS server. These paths are
following : 
   a. http://localhost/test
   b. http://localhost/test2

If a user tries to access the test folder then Shibboleth SP takes the user
to the IDP for authentication and user gets access to the web page (which is
expected). 

But, on the same browser if the user manually changes the URL from 
http://localhost/test to  http://localhost/test2 and hits the enter then
Shibboleth SP gives access to that page as well without taking user to the
IDP. (which is not expected)

Moreover, if the same user punches the URL(cut the URL and paste it to the
browser )   http://localhost/test2 and then tries to access it then in this
case shibboleth SP takes the user to the IDP. (which is expected)

Kindly let me know where I am going wrong in this case. 

Thank you for your help !!

Below is my RequestMapper in Shibboleth2.xml file : 

<RequestMapper type="Native">
        <RequestMap>
            
            <Host name="localhost">
            <Path name="test" authType="shibboleth" requireSession="true" 
forceAuthn= "true"
authnContextClassRef="urn:oasis:names:tc:SAML:2.0:post:ac:classes:nist-800-63:1"/>
            <Path name="test2" authType="shibboleth" requireSession="true"
forceAuthn= "true"
authnContextClassRef="urn:oasis:names:tc:SAML:2.0:post:ac:classes:nist-800-63:2"/>
            </Host>
            
            
        </RequestMap>
    </RequestMapper>



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/URL-access-given-to-Protected-page-by-Shibboleth-Service-Provider-tp7602672.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.