MCB SSO not requiring greater authentication methods

[Caskey, Paul]

So, do you think it will ever be possible to specify the authn method in relying-party.xml (i.e. will that bug get fixed?)?



> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-
> bounces at shibboleth.net] On Behalf Of Paul Hethmon
> Sent: Friday, April 10, 2015 10:37 AM
> To: Shibboleth Users
> Subject: Re: MCB SSO not requiring greater authentication methods
> 
> I don’t think it will work.
> 
> When MCB handles previous session (which it should), the context value it
> has available to determine what to do is from the last successful
> authentication. So if the previous allowed value matches what the user has
> used, then previous session handling takes place and there is never another
> call to the attribute resolver.
> 
> Paul
> 
> 
> > On Apr 10, 2015, at 10:11 AM, Ho, PeiQuan <PeiQuan.Ho at tufts.edu>
> wrote:
> >
> > This is what I'm currently doing.   I'm using a scripted attribute resolver call
> "authContext" that is determine by checking the value of the SP ID and
> another value for the user.  This value is then passed to the MCB as its
> attributeResolverID which I thought would then set the MCB authnContext
> to the one specified by the authContext generated value.  Currently, this
> does work.  It just doesn't work when doing SSO... such as when I first go to
> an SP that the MCB determines to only require password, then go to a
> second SP that the MCB determines requires two-factor, the second SP does
> not force the two-factor step.  Is this do-able with Shib and MCB?  We're
> currently using shib IDP 2.4.1.
> >
> 
> -----
> Paul Hethmon
> Chief Software Architect
> paul.hethmon at clareitysecurity.com
> 
> 
> --
> To unsubscribe from this list send an email to users-
> unsubscribe at shibboleth.net