Background
The configurations below are for an Identity Provider wanting to use Username/Password authentication and return Silver assurance. In the first configuration, the IdP is configured to always return Silver assurance. In the second configuration, the IdP returns Silver assurance if the Service Provider requests Silver assurance; but if the SP does not request Silver assurance, the IdP returns PasswordProtectedTransport.
Note: The examples presented here were tested with Shibboleth IdP software version 2.3.8.
Note 2: In the XML code examples below, there is an intentional typo in URLs, with a space between "http
" and the colon ":
" (i.e., "http :
"). This is because the Confluence XML formatter strangely hides URLs from display. I have circumvented this issue by adding a space in the examples. Do not copy the space in your configuration files.
Configuration 1: IdP Always Returns Silver Assurance
In the Shibboleth IdP software v.2.3.8, the UsernamePassword <LoginHandler>
returns a single <AuthenticationMethod>
. By default, "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
is returned. This can be changed to Silver as follows.
First, modify web.xml
(either the WEB-INF/web.xml
file in the deployed war/idp.war
file, or in shibboleth-identityprovider-2.3.8/src/main/webapp/WEB-INF/web.xml
and then redeploy idp.war
) by adding an <init-param>
section as follows.
Code Block | ||||
---|---|---|---|---|
| ||||
<!-- In WEB-INF/web.xml --> <!-- Servlet for doing Username/Password authentication --> <servlet> <servlet-name>UsernamePasswordAuthHandler</servlet-name> <servlet-class>edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet</servlet-class> <load-on-startup>3</load-on-startup> <init-param> <param-name>authnMethod</param-name> <param-value>http ://id.incommon.org/assurance/silver</param-value> </init-param> </servlet> |
Then in conf/handler.xml
(under the IdP installation directory), add a Silver assurance <AuthenticationMethod>
to the UsernamePassword <LoginHandler>
as follows.
Code Block | ||||
---|---|---|---|---|
| ||||
<!-- In conf/handler.xml --> <!-- Username/password login handler --> <ph:LoginHandler xsi:type="ph:UsernamePassword" jaasConfigurationLocation="file:///opt/shibboleth-idp/conf/login.config"> <ph:AuthenticationMethod>http ://id.incommon.org/assurance/silver</ph:AuthenticationMethod> <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod> </ph:LoginHandler> |
You will need to redeploy idp.war
since web.xml
has been modified.
Configuration 2: IdP Returns Silver Assurance Only When Asked
In this configuration, the IdP returns Silver when the SP asks for Silver assurance, but returns the default PasswordProtectedTransport when the SP does NOT request Silver. For this functionality, we duplicate the original (unmodified) Username/Password sections in web.xml
and handler.xml
and modify the duplicated sections to be specific to Silver. Both configurations use the same Username/Password Login page, but the new section handles Silver, while the original section handles PasswordProtectedTransport (as well as no specific authentication method requested by the SP).
First, modify web.xml
by duplicating the unmodified Username/Password section, and then making modifications for Silver. Both sections are shown below for completeness.
Code Block | ||||
---|---|---|---|---|
| ||||
<!-- In WEB-INF/web.xml --> <!-- Servlet for doing Username/Password authentication --> <servlet> <servlet-name>UsernamePasswordAuthHandler</servlet-name> <servlet-class>edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet</servlet-class> <load-on-startup>3</load-on-startup> </servlet> <servlet-mapping> <servlet-name>UsernamePasswordAuthHandler</servlet-name> <url-pattern>/Authn/UserPassword</url-pattern> </servlet-mapping> <!-- Servlet for doing Username/Password Silver authentication --> <servlet> <servlet-name>UsernamePasswordSilverAuthHandler</servlet-name> <servlet-class>edu.internet2.middleware.shibboleth.idp.authn.provider.UsernamePasswordLoginServlet</servlet-class> <load-on-startup>3</load-on-startup> <init-param> <param-name>authnMethod</param-name> <param-value>http ://id.incommon.org/assurance/silver</param-value> </init-param> </servlet> <servlet-mapping> <servlet-name>UsernamePasswordSilverAuthHandler</servlet-name> <url-pattern>/Authn/UserPasswordSilver</url-pattern> </servlet-mapping> |
In the new section above, <servlet-name>
(in two places) and <url-pattern>
were modified by adding "Silver" to the text. Also, the <init-param>
section was added to return Silver assurance by default.
Then modify conf/handler.xml
by duplicating the unmodified UsernamePassword <LoginHandler>
section, and then making modifications for Silver. Both sections are shown below for completeness.
Code Block | ||||
---|---|---|---|---|
| ||||
<!-- In conf/handler.xml --> <!-- Username/password login handler --> <ph:LoginHandler xsi:type="ph:UsernamePassword" jaasConfigurationLocation="file:///opt/shibboleth-idp/conf/login.config"> <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod> </ph:LoginHandler> <!-- Username/password Silver login handler --> <ph:LoginHandler xsi:type="ph:UsernamePassword" jaasConfigurationLocation="file:///opt/shibboleth-idp/conf/login.config" authenticationServletURL="/Authn/UserPasswordSilver"> <ph:AuthenticationMethod>http ://id.incommon.org/assurance/silver</ph:AuthenticationMethod> </ph:LoginHandler> |
In the new section above, a new parameter "authenticationServletURL
" was added to match the <url-pattern>
entry in the web.xml
. Also the <AuthenticationMethod>
was changed to Silver to match the <init-param>
section in the web.xml
.
You will need to redeploy idp.war
since web.xml
has been modified.