how to make shibboleth SP re-send authnRequest for a different authnContext

[Kim, Allan]

Define a path-based SP application override for /twofactor that uses MFA, which will create a new session initiator and therefore a new session context. When you request /twofactor the SP will ignore any authentication result for /secure or /anything_else and should shoot you back to the IdP to log in with MFA. The config is a bit verbose/messy but it should work.

https://wiki.shibboleth.net/confluence/display/SHIB2/NativeSPApplicationOverride


From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Hong Ye
Sent: Tuesday, January 17, 2017 9:29 AM
To: Shib Users <users at shibboleth.net>
Subject: how to make shibboleth SP re-send authnRequest for a different authnContext

Hello,

I have installed a Shibboleth service provider v 2.6. The configuration is as following:

<Location /secure>
  AuthType shibboleth
  ShibCompatWith24 On
  ShibRequestSetting requireSession 1
  require shib-session
  ShibUseHeaders On

  require valid-user
</Location>

<Location /twofactor>
  AuthType shibboleth
  ShibUseHeaders On
  ShibRequestSetting authnContextClassRef http://cornell.edu/duo
  require authnContextClassRef http://cornell.edu/duo
</Location>

When I don’t have a session and accessed  /twofactor, I was promoted for primary authentication, then duo authentication. It worked as expected. But if I accessed /secure first, I was prompted for primary authentication and a session was established. Then I accessed /twofactor, I got "You don't have permission to access /twofactor on this server.” I was hoping SP send a new authnRequest to IDP but it didn’t.

I also tried added following to shibboleth2.xml, but it doesn't help.

<SessionInitiator type="SAML2" id="Login" Location="/twofactor"
             entityID="https://shibidp-test.cit.cornell.edu/idp/shibboleth"
             authnContextClassRef="http://cornell.edu/duo"
             forceAuthn="true" />

How to make SP re-send authnRequest?

Thanks,

Hong
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170118/0f9cdee5/attachment-0001.html>