要求使用相同的IDP重新进行身份验证-Spring SAML

Question

@vschafer

I have a scenario where my application acts as one of the service providers. My application interacts with another service provider as well to get access. But both the service providers are communicating with the same IDP for authentication.

1. user logs into my application by validating against the IDP
2. User is provided access to the application upon successful authentication
3. Now, user tries to access a resource in the application
4. User is redirected to another service provider application which is also tied with the same IDP for authentication
5. Though the user is authenticated once with the same IDP, the user is asked to authenticate again with the second service provider.

I believe the user should not be allowed to authenticate again forcefully. Please let me know if my understanding on the same is correct or not.

More over, does forceAuthn has a role to play in this scenario??

Answer 1

All of this should not be in any way related to your application or Spring SAML. Once you redirect user to the second application (step 4), it is its responsibility to interact with the IDP (send its own AuthnRequest and receive a Response ) and there's nothing you can affect about it anymore.

It is possible that the second application is setting the forceAuthn flag when sending AuthnRequest to the IDP - forcing the IDP to re-authenticate your user. It could also be related to some setting on the IDP side, or perhaps some cookie problems. You should communicate with the IDP's owners and ask them to troubleshoot why is the user asked for re-authentication (for example by examining their logs) instead of being single signed-on.