search

canada-ca / CATS-STAE

Cyber Authentication Technology - Technologie d’authentification électronique
https://canada-ca.github.io/CATS-STAE/
15 stars 1 forks source link

ForceAuthn - Clarification #31

Closed lsleduc closed 4 years ago

lsleduc commented 4 years ago

The question is around the interpretation of the second bullet point for ForceAuthn in the CATS spec.

"if ForceAuthn is used and the authentication is successful, this will reset the IDPs AuthnInstant for this principal."

The below Test Case below, hopefully helps with context. When ForceAuthn is used, the IDP need to reset the users session and setup a new session with the RP that requested the ForceAuthn for that user (based on the second bullet of the spec, which says ‘…this will reset the IDPs AuthnInstant for this principal.’). This is what happens in Step 4. So the new session doesn’t contain anything for any other RPs which may have been logged into before by the user. Therefore, when the user now performs a logout from the RP that had requested the ForceAuthn (this is step 5), the user is not logged out of those other RPs (this is what step 6 highlights).

Test Case:

  1. Open private Browser
  2. In tab1 - Open RP1 - LOA2 - CSP1 - user : testab1 , do authentication - PAI1 should be displayed
  3. In tab2 - Open RP3 - LOA2 - SSO, do authentication - PAI2 should be displayed
  4. In tab3 - Open RP2 - LOA2 - CSP1 - FORCE AUTHN - user: testab1 (use the same user as RP1), do authentication - PAI3 should be displayed
  5. Logout(Redirect) from RP2 - Logout Successful
  6. Refresh RP1 and RP3 tabs - Nothing changed, still, they are logged in
  7. Logout(Redirect) from RP1 - Logout Successful screen displayed
  8. Refresh RP3 tab - User logged out.

Is this the correct outcome for step 6? If not, what would be the solution? • Option 1: The logout in step 5, causes the other RPs to be logged out. • Option 2: When the user completes step 4, they should be logged out of all other RPs at that time.

Thanks

harrdou commented 4 years ago

That is not the expected outcome for step 6.

I suspect you may be encountering some new cookie blocking features that have been implemented in some browsers over the last few weeks. I'd suggest re-doing the test in a regular (not private) browser to see if it behaves differently. If you see the same behaviour then there may be an issue at the IDP.

lsleduc commented 4 years ago

Thanks will make sure the issue is corrected to have all user sessions logged out as expected.

Thanks