<div dir="ltr">Thanks, but I dont think we uderstand each other. I use custom login handler so auhentication method you talk about is always<br><div><div> <ph:LoginHandler xsi:type="ph:ExternalAuthn"</div><div>
externalAuthnPath="redirect.jsp"</div><div> supportsForcedAuthentication="true"></div><div> <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</ph:AuthenticationMethod></div>
<div> </ph:LoginHandler></div></div><div><br></div><div>Authentication methods I talk about are inside this login hander and shibboleth doesn't know nothing about them right now. I think I should do something inside that redirect.jsp (like call my external jar and check what method was used for example from cookies or so) and then somehow redirect user either as authenticated or sanding new request like you suggested. But i dont know if this can be done and if so, how :)</div>
</div><div class="gmail_extra"><br><br><div class="gmail_quote">2014-02-17 15:30 GMT+01:00 Peter Schober <span dir="ltr"><<a href="mailto:peter.schober@univie.ac.at" target="_blank">peter.schober@univie.ac.at</a>></span>:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">* Raadush <<a href="mailto:raadush@gmail.com">raadush@gmail.com</a>> [2014-02-17 15:10]:<br>
<div class="">> I want to change it to something like this:<br>
><br>
> user accesses SP1 -> he is redirected to my IDP -> authenticates using<br>
> password -> SP1 accepts it<br>
> user accesses SP2 -> he is redirecred to my IDP -> IDP checks if he used<br>
> strong enough method when he authenticated himself at SP1 -> if he USED<br>
> strong enough method, IDP authenticates him based on previous session like<br>
> before, if he DIDNT used strong enough method, he is forced to<br>
> re-authenticate<br>
<br>
</div>The Shib IDP reports the authentcation method used to any SP, so SP2<br>
can check that and decide to do whatever it wants (e.g. using your own<br>
code invoked from a sessionHook), such as sending a new authentication<br>
request to the IDP requesting a specific authnContext (and/or<br>
forcedAuthn).<br>
For any advanced behaviour at the IDP not supported out of the box<br>
you'd need a custom login handler. I'd start looking at and<br>
contributing to the MCB one.<br>
-peter<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br></div>