SSO session & password change

[IAM David Bantz]

I’m being asked to detect and act on changes in the status of directory
records. [We currently provide a way for accounts that fail normal LDAP
authentication because the account has expired to access specific services;
are about to deploy a new “lock” directory attribute to stop an otherwise
valid SSO session being used to access additional SPs.]

Next up is a request to detect a directory password change after the SSO
session was created and require the user to re-authenticate even if they
could otherwise use an existing valid SSO session. Stated use case is a
user who suspects their account is compromised and changes the password so
as to prevent misuse. It seems possible in principle to compete the times
in the AD attribute pwdLastSet with the SSO’s getCreationInstant, but I’m
unclear how to force re-authentication.

Are others invoking something like this function? It seems to impose
inconvenience on normal password change events and add significant overhead
for a very small number of uses. Is there a better approach? Is it to be
avoided for other reasons?

David St. Pierre Bantz
UAlaska IAM
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210728/dc599476/attachment.htm>