Disable SSO for Specific SP?

[Cantor, Scott]

On 1/15/16, 12:09 PM, "users on behalf of McKean, Brandon Scott - mckeanbs" <users-bounces at shibboleth.net on behalf of mckeanbs at jmu.edu> wrote:



>Hi Everyone,
> 
>From what I’m reading, turning off SSO entirely can be done by editing the idp.properties file in Shibboleth 3. Is it possible to have Shibboleth disable SSO functionality for a specific SP, such that your session from it or from another pool of SPs would still trigger authentication between them?

That would be ForceAuthn, basically, so the general answer is that if you want sessions on, but not used for some SP, the expected way would be to have it indicate ForceAuthn in its AuthnRequest.

What we haven't ever done is implement a relying-party driven mechanism to actually "presume" ForceAuthn.

-- Scott