Shibboleth Developers

["Scott Cantor" <>]

> I'm sure it's been discussed before as this is an issue with any SSO  
> solution, but I didn't see it on the roadmap... Are there formal  
> plans at all to allow an SP (particularly a highly-sensitive  
> application) to request re-authentication of the user?

SAML 2.0 includes a ForceAuthn flag. Of course, that doesn't guarantee the
IdP actually interacts with the user, but it's the equivalent of what you're
talking about.

There's also an IdP supplied ReauthenticateOnOrAfter stamp that bounds the
session at the SP from the IdP end.

-- Scott