Disable SSO for Specific SP?

[Cantor, Scott]

On 4/28/17, 11:42 AM, "users on behalf of Timo Tunturi" <users-bounces at shibboleth.net on behalf of timo.tunturi at aalto.fi> wrote:
> This specific need only came about less than a week ago.

Ok, but it's clear this has nothing at all to do with your use case.
 
> A client browser already has a valid global IdP session with a lower 
> grade authentication method. How can I disregard that session on the IdP 
> side for specific SPs and require them to to authenticate again with a 
> different method? Any pointer would be nice.

By specifying a defaultAuthenticationMethods property in a relying-party override, and appropriately configuring all the various pieces to handle the right supported custom AuthnContextClassRefPrincipals so that the system will invoke the proper authentication logic at the right times, generally with the MFA flow to orchestrate things.

> I already received advice to try and do this with an inbound 
> interceptor. Something I will look into unless I find that I'm a tool 
> and this can be acchieved with basic configuration.

No, that is absolutely incorrect advice.

> I realize it shouldn't be. Thus far it just has been the only way I have 
> been somewhat able to disregard a global IdP session for particular SPs.

The IdP will not reuse an AuthenticationResult if it doesn't satisfy the request. If the SP can't do its job and request what it requires, you have to supplement it by doing that in the configuration of the IdP and make sure the login flows are configured to support the appropriate Principals and don't support the wrong ones.

> Somewhat on the same note, the Shibboleth SP side is not particularly 
> geared toward requiring a session with different methods of 
> authentication for different locations behind the same Shib SP.

The SP can deny access but it's an application function to route such a denial into logic that would cause a new session to be requested. It's also possible to use ApplicationOverrides to handle that case.

> Having exhausted my understanding with configuring the SP, the 
> authentication context class apache httpd env variable isn't available 
> during rewrite phase even with look-ahead.

It isn't there early enough for that, that's not how Apache works.

-- Scott