MCB SSO not requiring greater authentication methods

[Hong Ye]

We are not using IDP’s session management code. We have our own Apache module that do authentication and user session management.

Hong

On Apr 10, 2015, at 2:48 PM, Ho, PeiQuan <PeiQuan.Ho at tufts.edu> wrote:

> Hey Hong,
> 
> 	I tried this method that you mentioned, and it works in that I got prompted to login on both sites and they both use the desired auth method.  On our SPs though, both sites required password even if I go to the Duo SP first.  Did you get around this using your IDP's session management code?
> 
> Thanks,
> -PQ
> 
> 
> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Hong Ye
> Sent: Friday, April 10, 2015 11:58 AM
> To: Shib Users
> Subject: Re: MCB SSO not requiring greater authentication methods
> 
> Our IDP uses our in house developed webLogin for authentication which has its own session management. I set previousSession=false in MCB loginHandler that disabled Shibboleth SSO. It seems working fine. If user logged in to the SP1 that only require password, then goes to SP2 that require duo, user will be only prompted for DUO. If user goes to SP2 first, then SP1, user does not need to do any login when goes to SP1. 
> 
> Does anyone see any issue with disabling previous session in my case?
> 
> Thanks,
> Hong
> 
> On Apr 10, 2015, at 11:36 AM, Paul Hethmon <paul.hethmon at clareitysecurity.com> wrote:
> 
>> I don't think it will work.
>> 
>> When MCB handles previous session (which it should), the context value it has available to determine what to do is from the last successful authentication. So if the previous allowed value matches what the user has used, then previous session handling takes place and there is never another call to the attribute resolver.
>> 
>> Paul
>> 
>> 
>>> On Apr 10, 2015, at 10:11 AM, Ho, PeiQuan <PeiQuan.Ho at tufts.edu> wrote:
>>> 
>>> This is what I'm currently doing.   I'm using a scripted attribute resolver call "authContext" that is determine by checking the value of the SP ID and another value for the user.  This value is then passed to the MCB as its attributeResolverID which I thought would then set the MCB authnContext to the one specified by the authContext generated value.  Currently, this does work.  It just doesn't work when doing SSO... such as when I first go to an SP that the MCB determines to only require password, then go to a second SP that the MCB determines requires two-factor, the second SP does not force the two-factor step.  Is this do-able with Shib and MCB?  We're currently using shib IDP 2.4.1.
>>> 
>> 
>> -----
>> Paul Hethmon
>> Chief Software Architect
>> paul.hethmon at clareitysecurity.com
>> 
>> 
>> -- 
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net