Shib sessions, portal services, and shib-cas-authenticator

[Janemarie Duh]

Hello,

We are running IdP v4.1.6 with shib-cas-authenticator v4.0.0. Most, but not
all, Shib services go to CAS and there are numerous services that are
CAS-only. Shib controls SSO sessions.

We use a service (Campus Cloud by Ready Education, makers of CampusGroups)
as a portal to access third-party services. These services use either our
IdP or straight CAS for SSO. The portal service itself uses Shib with
shib-cas.

The desired behavior is a user having a portal session who accesses one of
the services from a tile within the portal shouldn't be prompted to auth
again even though their SSO session has expired. Services using straight
CAS work as desired. The portal extracts a request token that CAS looks for
using custom JAVA code. Even though the Shib / CAS SSO session ends after 3
hours, accessing a CAS-only service doesn't require authing again because
of the existence of the token. The portal session only ends if a user
clicks 'log out'.

The one shib-cas service we added (Workforce) doesn't work as desired.
Shib, of course, isn't aware of the auth token the portal stashes. So,
we're left trying to come up with a solution. It's unclear to me how Shib
with shib-cas-authenticator handles sessions, plus there's the dependence
on the user having a portal session.

Would a fix work that focuses on the Shib session, such as using
idp.session.defaultSPlifetime in the RP, or another method that renews the
session? If it's possible to make Shib aware of the portal token by
configuring the IdP to receive, store, and pass it back through shib-cas,
we're open to doing that.

I appreciate any guidance.

              Janemarie

-- 

*Janemarie Duh*
UD Information Technologies
*Identity and Access Management Specialist*
duhj at udel.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230914/6a6f8fef/attachment.htm>