Hi -- sorry to piggyback off this thread, but I think my question is related.<br><div><br></div><div>First, I'm using this setup: CAS + Shib + shib-cas-authenticator. CAS is using ActiveDirectory to authenticate users. I'm using IdP unsolicited initialization to log in to Concur (which requires that login request begin at the IdP).</div>
<div><br></div><div>I can login to Concur fine using this set up. When I log out of Concur, it logs me out there and forwards me to my cas/logout (per my instruction). Shibboleth seems to keep its session going (because it doesn't know anything about the user being logged out at CAS). </div>
<div><br></div><div>I want Shibboleth to basically NOT keep a session and to ask CAS about the user being logged in every time. This way, CAS will control the login time (as far as Shib and CAS are concerned). In a nutshell, here's what I've done to try to make that happen:</div>
<div><br></div><div>shib conf/handler.xml</div><div><div><ph:LoginHandler xsi:type="ph:ExternalAuthn"<br></div><div> externalAuthnPath="/authn/external"</div><div> authenticationDuration="1"</div>
<div> supportsForcedAuthentication="true" ></div><div> <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod></div>
<div></ph:LoginHandler></div></div><div><br></div><div>(notice: authenticationDuration)</div><div><br></div><div>Commented out the Previous Session:</div><div><div> <!--</div><div> <ph:LoginHandler xsi:type="ph:PreviousSession"></div>
<div> <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession</ph:AuthenticationMethod></div><div> </ph:LoginHandler></div><div> --></div></div><div><br></div><div>
shib conf/internal.xml</div><div>Shortened the Session time (or at least that's what I thought I was doing).</div><div><br></div><div><div> <bean id="shibboleth.SessionManager" class="edu.internet2.middleware.shibboleth.idp.session.impl.SessionManagerImpl" depends-on="shibboleth.LogbackLogging"></div>
<div> <constructor-arg ref="shibboleth.StorageService"/></div><div> <constructor-arg value="60000" type="long"/></div><div> <!--</div><div> <constructor-arg value="1800000" type="long"/></div>
<div> --></div><div> </bean></div></div><div><br></div><div>When I look at the log on a reattempt to log in through IdP Unsolicited SSO, I have these interesting lines:</div><div><br></div><div><div>13:31:51.139 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:224] - Creating login context and transferring control to authentication engine</div>
<div>13:31:51.140 - DEBUG [edu.internet2.middleware.shibboleth.idp.util.HttpServletHelper:167] - Storing LoginContext to StorageService partition loginContexts, key e1d7af0f-c57d-47f6-8156-aa55f227aa14</div><div>13:31:51.140 - DEBUG [edu.internet2.middleware.shibboleth.idp.profile.saml2.SSOProfileHandler:237] - Redirecting user to authentication engine at <a href="https://idp.HIDDEN.com:443/idp/AuthnEngine">https://idp.HIDDEN.com:443/idp/AuthnEngine</a></div>
<div>13:31:51.172 - DEBUG [edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:160] - No session associated with session ID ZGU1MjRmZTdiNWM4ZWZkNWQwYzY5MzI4YzRmY2MyMjQ3OWNiNDk3ZGNhZTQ2OWJkNDdmOTM0MjgzYzk5ZGZiNQ== - session must have timed out</div>
<div>13:31:51.173 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:209] - Processing incoming request</div><div>13:31:51.173 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:240] - Beginning user authentication process.</div>
<div>13:31:51.173 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:283] - Filtering configured LoginHandlers: {urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport=edu.internet2.middleware.shibboleth.idp.authn.provider.ExternalAuthnSystemLoginHandler@75ad2db5}</div>
<div>13:31:51.173 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:464] - Selecting appropriate login handler from filtered set {urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport=edu.internet2.middleware.shibboleth.idp.authn.provider.ExternalAuthnSystemLoginHandler@75ad2db5}</div>
<div>13:31:51.174 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:497] - Authenticating user with login handler of type edu.internet2.middleware.shibboleth.idp.authn.provider.ExternalAuthnSystemLoginHandler</div>
<div>13:31:51.174 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.provider.ExternalAuthnSystemLoginHandler:102] - Forwarding authentication request to /authn/external</div><div>13:31:51.234 - DEBUG [edu.internet2.middleware.shibboleth.idp.session.IdPSessionFilter:160] - No session associated with session ID ZGU1MjRmZTdiNWM4ZWZkNWQwYzY5MzI4YzRmY2MyMjQ3OWNiNDk3ZGNhZTQ2OWJkNDdmOTM0MjgzYzk5ZGZiNQ== - session must have timed out</div>
<div>13:31:51.234 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:144] - Returning control to authentication engine</div><div>13:31:51.234 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:209] - Processing incoming request</div>
<div>13:31:51.235 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:514] - Completing user authentication process</div><div>13:31:51.235 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:585] - Validating authentication was performed successfully</div>
<div>13:31:51.235 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:696] - Updating session information for principal Richard.Navarrete@HIDDEN.com</div><div>13:31:51.235 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:700] - Creating shibboleth session for principal Richard.Navarrete@HIDDEN.com</div>
<div>13:31:51.236 - DEBUG [edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:806] - Adding IdP session cookie to HTTP response</div></div><div><br></div><div>I looks like it sends it to the External Auth, but I don't see anything happen on the CAS side. CAS is logged out so it appears this would create a login screen if it really contacted CAS (either 302 redirect or as a result of the user not being signed in).</div>
<div><br></div><div>What is confusing above is that it says "No session associated with session ID..." then returns to "auth engine" not sure if this is Shib or CAS, then "Completing user authentication process" then it validates it as successful? I don't understand how this could happen unless it's checking with itself for authentication... How can I kill the Shib session and make it check with CAS everytime for a valid auth?</div>
<div><br></div><div>Thanks in advance!</div><div>R</div><div><br></div><div>
<p class="">-----Original Message-----</p>
<p class=""><span class="">From: <a href="mailto:users-bounces@shibboleth.net"><span class="">users-bounces@shibboleth.net</span></a> [<a href="mailto:users-bounces@shibboleth.net"><span class="">mailto:users-bounces@shibboleth.net</span></a>] On</span></p>
<p class="">Behalf Of Michael A Grady</p>
<p class="">Sent: Thursday, November 01, 2012 10:26 AM</p>
<p class="">To: Shib Users</p>
<p class="">Subject: Re: IdP's Session Cookie</p>
<p class=""><br></p>
<p class=""><br></p>
<p class="">On Nov 1, 2012, at 9:02 AM, Cantor, Scott wrote:</p>
<p class=""><br></p>
<p class="">On 11/1/12 9:14 AM, "Paul Hethmon" <<a href="mailto:paul.hethmon@clareitysecurity.com"><span class="">paul.hethmon@clareitysecurity.com</span></a>></p>
<p class="">wrote:</p>
<p class=""><br></p>
<p class="">I'm pretty sure that session cookie is set regardless of the</p>
<p class="">PreviousSession handler being there or not. Even if session time is</p>
<p class="">set to 0, I think it gets set. It's just immediately invalid.</p>
<p class=""><br></p>
<p class="">Yes, the handler has nothing to do with the cookie being set.</p>
<p class=""><br></p>
<p class="">Thanks.</p>
<p class=""><br></p>
<p class="">Looks like the cookie causing problems (causing a user to be "remembered"</p>
<p class="">when such isn't desired) is a JSESSIONID cookie, scoped to the External</p>
<p class="">Authentication handler path. (The External Authn handler is what is being</p>
<p class="">used in this case.) I am correct in my reading of the documentation that the</p>
<p class="">authenticationDuration setting for a handler isn't supposed to matter if the</p>
<p class="">PreviousSession handler is not activated -- is that indeed correct?</p>
<p class=""><br></p>
<p class=""><span class=""><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthnSession">https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthnSession</a></span></p>
<p class=""><br></p>
<p class="">Which would presumably put the External Authn "trigger code"</p>
<p class="">(filter/servlet) at fault for this cookie and its use.</p>
<p class=""><br></p>
<p class=""><br></p>
<p class="">-- Scott</p>
<p class=""><br></p>
<p class=""><br></p>
<p class=""><br></p>
<p class="">--</p>
<p class="">Michael A. Grady</p>
<p class="">Senior IAM Consultant, Unicon, Inc.</p>
<p class=""><br></p>
<p class="">--</p>
<p class="">To unsubscribe from this list send an email to</p>
<p class=""><span class=""><a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></span></p>
<p class=""><br></p>
<p class=""><br></p></div>