IDP3 authn intercept question

[O'Dowd, Josh]

Hi Scott,

> What service page are you referring to? The only session they have is with the IdP. They can't ignore the intercept with respect to an SP.

We are having to re-create, with IDP3, a process we had with CAS where we interrupt the login-flow to do some data checking on the authenticated individual.  With CAS it was easy, because we could intercept after authentication, but prior to ticket granting and we could grant the ticket only when the form was properly submitted.  Our challenge now is that the IDP session is already established when the intercept occurs.

We have the intercept deciding whether or not show the form, based on some logic which requires a return attribute from the bindAuthentication and the user entered password. We are getting the password from the UsernamePasswordContext found in the authenticationContext.  Based on the logic, the intercept-flow either shows the form or sends the user on to the SP.

The problem is that the session with the IDP allows them to 're-navigate ' to the SP from the form that the intercept-flow is presenting , thus ignoring the intercept form and accessing the SP anyway.  The 2nd request to the SP is getting through the intercept because there is no longer a UsernamePasswordContext in the authenticationContext, so the intercept is forced to send the user on to the SP.

I know this probably seems like a strange process, but unfortunately, in our case it is necessary, for now.

-Josh

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, September 30, 2015 10:57 AM
To: Shib Users
Subject: Re: IDP3 authn intercept question

On 9/30/15, 12:00 PM, "users on behalf of O'Dowd, Josh" <users-bounces at shibboleth.net on behalf of Josh.O'Dowd at mso.umt.edu> wrote:

>Good Morning,
> 
>We have a post-authn intercept with a flow that provides a user form.  When the intercept-flow is engaged, authentication has already been achieved.  In other words if the user ignores the form and navigates to the service page,  they would already have a session.

What service page are you referring to? The only session they have is with the IdP. They can't ignore the intercept with respect to an SP.

> 
>What we want to do is complete the authenticated redirect ONLY if the user successfully submits the form presented by our intercept-flow.

Any intercept works like that. If it doesn't signal a "proceed" as the result of the subflow, the IdP won't issue an assertion, it will stop there with an error.

> 
>So, for this purpose, can we then safely negate the authentication until the form is done, by removing the AuthenticationResult from the AuthenticationContext, and the Subject from the SubjectCanonicalizationContext?  

Certain things will break in unreliable and unpredictable ways, but that's not the right approach.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net