Request map and alternate SP entityIDs

[Wessel, Keith]

Thanks. I thought about this some more, though, and trying to do this with two paths on the same host won't work for all the reasons sited in the wiki. Main reason is that once the user has a session, they won't get sent back to the IdP. If they start by accessing the path that uses the non-2FA entityID, they'll get their session. They can then visit any other path on the host and not have to log in again.

Scott, your suggestion of requesting the right authn context will only get us so far. Now that we're requiring certain faculty, staff and grad students to always 2FA regardless of whether just password was requested or no context was requested, the SP has no way of signaling that it's exempt. It'd be cleaner, but our security folks want to force these populations to always do a second factor auth except for with a small set of exempted apps.

So, off to help the SP admin do this with a second hostname instead.

Thanks,
Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Takeshi NISHIMURA
Sent: Wednesday, October 10, 2018 11:17 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Request map and alternate SP entityIDs

Hi Keith,

https://wiki.shibboleth.net/confluence/display/SP3/ApplicationOverride

You must define its own handler such as handlerURL="/Non2FA/Shibboleth.sso".

Though I don't think it is necessary to define another entityID in your case.

Best regards,
Takeshi

> 2018/10/11 0:18, Wessel, Keith <kwessel at illinois.edu> wrote:
> 
> Hi, all,
> 
> We have an SP trying to select a different entityID for specific paths so that we can exempt logins to applications at those paths from our 2FA policy. I'm able to add exempted entityIDs on the IdP if we can just get the SP to use the alternate entityID.
> 
> All the docs say something like this should work in SP3, but no matter what we do, the IdP is getting a request from the SP's default entityID.
> 
> <RequestMapper type="Native">
> <RequestMap applicationId="default">
> <Host name="example.illinois.edu" authType="shibboleth" requireSession="true">
> <Path name="EDS" authType="None" requireSession="false" />
> <Path name="Non2FA" entityIDSelf="https://example.illinois.edu/non2fa" />
>     </Host>
> </RequestMap>
> </RequestMapper>
> 
> Any thoughts why the alternate entityID would be used for requests to /Non2FA?
> 
> Thanks,
> Keith

-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net