availability of "PrivateCredentials" beyond initial login event

[Cantor, Scott]

On 4/28/17, 9:33 AM, "users on behalf of Liam Hoekenga" <users-bounces at shibboleth.net on behalf of liamr at umich.edu> wrote:

> Why is it that when shibboleth.authn.Password.RetainAsPrivateCredential is enabled, the password remains available after the
> initial authentication event, but with shibboleth.authn.Krb5.PreserveTicket, the TGT is only available during the initial event?

Because I have no serializer implemented for a Kerberos ticket. There's actually no serialization of "credentials" in the Subjects, I only did that for Principals. It's a TODO in the code, see net.shibboleth.idp.authn.impl.DefaultAuthenticationResultSerializer

I don't think it saves off the X.509 certificate in that case, for example.
 
> I see the note in https://wiki.shibboleth.net/confluence/display/IDP30/ScriptedAttributeDefinition

It is fundamentally the case that it is no longer possible to recover the Subject on the back channel. That is true regardless of these settings and isn't connected to either of them. You won't get the password there either.

-- Scott