Initiating an error?

[Jan Vilhuber]

I thought about just clearing the cookies in the sessionhook (definitely easy), but that leaves a hole in that the session still exists in the SP in memory! So if the browser somehow doesn't clear the cookie or a semi-malicious (or oblivious?) actor keeps a copy of the cookie, then they can still get back in. So the session in the SP must be cleared, too; clearing the cookie in the browser is not sufficient.

But there's other options, too, that I've come across since yesterday, like the SOAP API to clear the session in the SP (the internal server could call that to actually delete the in-memory session). I'll need to investigate that as well as the AttributeChecker (read about that before but couldn't quite 'get it' at the time).

What would be really helpful is if the shibboleth wiki had more actual examples of how people solved some of these issues in the past. The wiki is chock full of information, but a little light on examples (and I seem to 'get' things better with examples, than esoteric lists of configuration parameters). I can't imagine I'm the first to try to figure out how to do this, and my use case is most likely not very special (pretty common, I would guess).

Thanks.
jan

________________________________________
From: users <users-bounces at shibboleth.net> on behalf of Peter Schober <peter.schober at univie.ac.at>
Sent: Friday, September 15, 2017 3:07 PM
To: users at shibboleth.net
Subject: Re: Initiating an error?

* Jan Vilhuber <JVilhuber at absolute.com> [2017-09-15 09:54]:
> I use sessionhook in shibboleth SP to do some application setup. Should something go wrong, I want 2 things:
> 1) we need to clear the shibboleth SP session (don't want to leave the user in an authenticated state if authorization failed)
> 2) A customized error needs to be presented to the user giving information about what went wrong.

Both things are possible using either the AttributeChecker handler or
a custom sessionHook.
For 1 the AttributeChecker handler has the flushSession="true" setting.
For 2 you'd adapt the filename and/or content of the template to render.

With a custom sessionHook to clear the Shib SP session you could
simply remove all the HTTP Cookies set by the SP (implementation
detail, so names might change; though I think you can set/fix the
cookie names yourself, if desired), or even simpler remove/expire all
HTTP Cookies the HTTP User Agent sent to you. It's your own code, you
can do whatever you want.
And of course you can render any file/template/content you want from
your own sessionHook code as well.

-peter
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net