how to make shibboleth SP re-send authnRequest for a different authnContext

[Hong Ye]

Hello,

I have installed a Shibboleth service provider v 2.6. The configuration is as following:

<Location /secure>
  AuthType shibboleth
  ShibCompatWith24 On
  ShibRequestSetting requireSession 1
  require shib-session
  ShibUseHeaders On

  require valid-user
</Location>

<Location /twofactor>
  AuthType shibboleth
  ShibUseHeaders On
  ShibRequestSetting authnContextClassRef http://cornell.edu/duo
  require authnContextClassRef http://cornell.edu/duo
</Location>

When I don’t have a session and accessed  /twofactor, I was promoted for primary authentication, then duo authentication. It worked as expected. But if I accessed /secure first, I was prompted for primary authentication and a session was established. Then I accessed /twofactor, I got "You don't have permission to access /twofactor on this server.” I was hoping SP send a new authnRequest to IDP but it didn’t.

I also tried added following to shibboleth2.xml, but it doesn't help.

<SessionInitiator type="SAML2" id="Login" Location="/twofactor"
             entityID="https://shibidp-test.cit.cornell.edu/idp/shibboleth"
             authnContextClassRef="http://cornell.edu/duo"
             forceAuthn="true" />

How to make SP re-send authnRequest?

Thanks,

Hong
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170117/855d3fd3/attachment.html>