donotcache and forceAuthn

[Manuel Haim]

On 23.08.2017 09:31 Manuel Haim wrote:
>> #if (!$authenticationContext.isForceAuthn())
> 
> Sorry, this was only half the solution. Seems we also need to look for a
> not-yet-established IdP session in login.vm (in order to always show the
> box at first login):
> 
> #set ($idpSession =
> $profileRequestContext.getSubcontext('net.shibboleth.idp.session.context.SessionContext',
> true).getIdPSession())
> 
> #if (!$idpSession || !$authenticationContext.isForceAuthn())
>   ...
> #end

*Sigh* it seems more complicated than I thought... By hiding the box,
the next login request will re-enable the cache, unless you add a hidden
input which sets donotcache=1 ...

I seem to have ended up with a workaround for IdP 3.3.1, as documented
here: https://issues.shibboleth.net/jira/browse/IDP-1207

Kind regards,
Manuel