Additional Entity in IIS

[Matthews, Lee (NIH/NIDDK) [E]]

So far I cannot figure out how to initiate the prompt to re-authenticate when using IIS.
I have been testing with Apache on the same system and using the config below I can get the prompt to re-authenticate.
<ApplicationOverride id="esig">
 <Sessions checkAddress="false" relayState="ss:mem" lifetime="60" handlerURL="/esig" timeout="60" cookieProps="; path=/esig; secure; HttpOnly" handlerSSL="true">
 <SSO entityID="https://FQDN/SAML2/IDP">
 SAML2
 </SSO>
 </Sessions>
 </ApplicationOverride>


Thanks in advance.

Lee
________________________________
From: Cantor, Scott <cantor.2 at osu.edu>
Sent: Wednesday, November 16, 2022 2:03 PM
To: Shib Users <users at shibboleth.net>
Cc: Matthews, Lee (NIH/NIDDK) [E] <lee.matthews at nih.gov>
Subject: [EXTERNAL] Re: Additional Entity in IIS

Creating a content grouping with a different entityID does not require an override, but your goal isn't that, but to create a session boundary.

Using an override (with the same entityID frankly) will partition the session cache and transiting the boundary between applications will ignore any session not created by and associated with the overridden application ID.

If it's not heading back to the IdP, it's not using the override.

Of course, SSO is SSO. The only control an SP has over the IdP experience re: the UI is the ForceAuthn flag, which often won't do what you want anyway, but absent that there's nothing you can do to limit SSO.

-- Scott


CAUTION: This email originated from outside of the organization. Do not click links or open attachments unless you recognize the sender and are confident the content is safe.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20221216/d5ed9697/attachment.htm>