<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 14 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri","sans-serif";
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri","sans-serif";}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal>Good morning, we have an portal application that is successfully working with shib/SSO. However, they want to bring up a sensitive ‘resource’ within the portal application and that they want to force a re-authentication. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Within the shibboleth2.xml file, we set forceAuthN=”true” which is the new sensitive resource<o:p></o:p></p><p class=MsoNormal><span style='color:#1F497D'><Path name="auth" authType="shibboleth" requireSession="true"/><o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'> <Path name="forcereauth" authType="shibboleth" requireSession="true" forceAuthn="true" /><o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Now, when coming from another shib application such as blackboard the forcereauth resource does indeed prompt for credentials, but if you first go into the auth resource, then the forcereauth resource it doesn’t prompt for credentials.<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>My question is should the new resource be an additional SP and forceAuthN, or is there a way (or better practice) to use the existing SP and modify something to make this work?<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Thanks everyone<o:p></o:p></span></p><p class=MsoNormal><span style='color:#1F497D'>Brent<o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p></div></body></html>