Another reason not to change IdP hostnames

[Wessel, Keith]

Seems like a better solution for something as central as the IdP would be to mark the password field on your login page as not allowed to be saved.

Or are some browsers ignoring that mark-up these days?

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Christopher Bongaarts
Sent: Monday, October 03, 2016 11:36 AM
To: Shib Users <users at shibboleth.net>
Subject: Another reason not to change IdP hostnames

So, Scott's advice for upgrading from IdP v2 to v3 is "do inplace 
upgrade, change as little as possible, then change things later". We're 
not doing that, and it has been perhaps more painful than simply ripping 
off the proverbial bandage...  So I have a cautionary tale to share 
about something we hadn't considered - why you should think twice before 
changing the hostname of your IdP.  We are doing so (leaving the 
entityID alone, which at least reduces one set of potential problems).

Over the weekend we cut over some of our heaviest hitters (Google Apps, 
Moodle, portal, and a couple others).  We started getting a trickle of 
calls Sunday night that grew significantly into Monday morning about 
users who were needing to get their password reset so they could log in 
to our V3 IdP.  At first, I thought this might be due to a 
synchronization problem in our LDAP directory between the password hash 
used by V2 (which looks up the attribute and does the hash and compare 
within our custom LoginHandler) and the one used by V3 (the standard 
LDAP userPassword hash, as we have V3 doing the more standard LDAP 
search+bind).

But it turns out the issue was that the users in question had saved 
their passwords in their browser (and WPA supplicants and mobile 
devices) and no longer remembered what it was.  And the password was 
tied to the V2 hostname, so the V3 login form was not auto-populating 
their password for them.

Once I realized what the real problem was, I was able to suggest a more 
pleasant workaround than forced password change - dig into your browser 
settings and tell it to show you your saved passwords - but I thought it 
might be worth sharing as a cautionary tale to others who are doing the 
same thing (I'm pretty sure I heard at least one other university was 
doing this at TechEx last week). It might still make sense to change it, 
but at least knowing this will allow your helpdesk to be prepared when 
the users come calling.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net