Re: [SourceID SSO-users] Identity Provider ReauthenticateOnOrAfter time

Hi Dave,
You are right. The current code seems to have a bug in it. In this reply,
I'll only try to point out where part of the bug is. I haven't isolated
where the logic to actually expire the session will be inserted yet.
Hopefully someone already has an answer.

I have found that the Authenticator class is making a call to set the
ReauthenticateOnOrAfter property which does nothing by itself. See item (2)
below, or the original AuthenticationStatementType1 class. The fix is to
actually set the reauth_on_or_after public string property as opposed to
the System.DateTime ReauthenticateOnOrAfter property. In fact, when you do
that and recompile your project, you should see on the home.aspx on the
sample provider, text that tells you when the session will expire.
The text message doesn't mean the session will expire however. I tested it
using a one minute session interval and tried hitting the home.aspx page
after having logged in and waited more than a minute. Unfortunately, it
still allowed me in.

I hope this helps. Please let me know if you/someone fixes this issue.
Thanks,
Mamoud.

p.s. I included the old and new code snippets below.


1) In Authenticator.cs (original code)
AuthenticationStatementType1 auth_stmt = new
AuthenticationStatementType1();
// Calculate ReauthenticateOnOrAfter, if so configured
                int authn_life =
Manager.Configuration.IdpAuthenticationLifespan;
                if (authn_life != 0)
                {
                    DateTime reauth_after = now.Add(new TimeSpan(0,0,
authn_life));
                    auth_stmt.reauth_on_or_after = reauth_after.ToString();
                }

// Calculate ReauthenticateOnOrAfter, if so configured
                int authn_life =
Manager.Configuration.IdpAuthenticationLifespan;
                if (authn_life != 0)
                {
                    DateTime reauth_after = now.Add(new TimeSpan(0,0,
authn_life));
                    auth_stmt.ReauthenticateOnOrAfter = reauth_after;
                }

Newly modified code:
// Calculate ReauthenticateOnOrAfter, if so configured
                int authn_life =
Manager.Configuration.IdpAuthenticationLifespan;
                if (authn_life != 0)
                {
                    DateTime reauth_after = now.Add(new TimeSpan(0,0,
authn_life));
                    auth_stmt.reauth_on_or_after = reauth_after.ToString();
                }


(2) In AuthenticationStatementType1 class (in
Liberty-architecture-protocols-schema-v1_1.cs):

      //This is where the ReauthenticateOnOrAfter property is declared as
public, but is not set anywhere else            except in the
reauth_on_or_after public property. However, the reauth_on_or_after
property is never called by the authenticator.cs, so the
ReauthenticateOnOrAfter is never set either.

      [System.Xml.Serialization.XmlIgnoreAttribute()]
        public System.DateTime ReauthenticateOnOrAfter;


[System.Xml.Serialization.XmlAttributeAttribute("ReauthenticateOnOrAfter")]
        public string reauth_on_or_after
        {
            get
            {
                return ReauthenticateOnOrAfterSpecified
                    ? ReauthenticateOnOrAfter.ToString("s") + "Z"
                    : null;
            }
            set
            {
                ReauthenticateOnOrAfterSpecified = true;
                  //This is where we set the ReauthenticateOnOrAfter prop.
                ReauthenticateOnOrAfter = System.DateTime.Parse(
                    value,
                    System.Globalization.DateTimeFormatInfo.InvariantInfo,
                    System.Globalization.DateTimeStyles.AdjustToUniversal);
            }
        }




                                                                                                                                         
                      "Dave Beery"                                                                                                       
                      <[email protected]>        To:       [email protected]                                                        
                      Sent by:                   cc:       (bcc: Mahmoud Lamriben/Technology/IPAPER)                                     
                      sso-users-bounces@s        Subject:  [SourceID SSO-users] Identity Provider ReauthenticateOnOrAfter time           
                      ourceid.org                                                                                                        
                                                                                                                                         
                                                                                                                                         
                      05/17/2004 11:07 AM                                                                                                
                      Please respond to                                                                                                  
                      "Users of the                                                                                                      
                      SourceID-SSO                                                                                                       
                      system"                                                                                                            
                                                                                                                                         
                                                                                                                                         




I do not see where in the code ReauthenticateOnOrAfter is ever checked.
  Once someone is logged in, it looks like they are logged in until the
session expires.

How do I keep track of the ReauthenticateOnOrAfter time so that it can
be verified each time the user comes back so that I know to prompt the
user for his login again?

Thanks,

Dave Beery

--
David Beery
accessIndiana

**********************************************************************
CONFIDENTIALITY NOTICE:
This E-mail and any attachments are confidential.  If you are not the
intended recipient, you do not have permission to disclose, copy,
distribute, or open any attachments.  If you have received this E-mail
in error, please notify us immediately by returning it to the sender and
delete this copy from your system.
Thank you.
accessIndiana, MyLocal.IN.gov, CivicNet
**********************************************************************

_______________________________________________
sso-users mailing list
[email protected]
http://mail.sourceid.org/mailman/listinfo/sso-users