[JIRA] Created: (SIDP-553) SAML 2 Login Context is treating AuthnContextDeclRef as equivalent to ClassRef

[Scott Cantor (JIRA)]

SAML 2 Login Context is treating AuthnContextDeclRef as equivalent to ClassRef
------------------------------------------------------------------------------

                 Key: SIDP-553
                 URL: https://issues.shibboleth.net/jira/browse/SIDP-553
             Project: Shibboleth IdP 2 - Java
          Issue Type: Bug
          Components: SAML 2
    Affects Versions: 2.3.6, 2.3.5, 2.3.4, 2.3.3, 2.3.2, 2.3.1, 2.3.0
            Reporter: Scott Cantor
            Assignee: Scott Cantor
            Priority: Minor
             Fix For: 2.3.7


The SAML 2 login context code is expressing the union of both ClassRef and DeclRef values as requested authentication methods. The problem is we don't distinguish that in the rest of the code, so the end result would be expressed as only a ClassRef in the resulting assertion, which violates the SAML spec.

We really don't support DeclRef in our outgoing SAML 2 code so we should just be ignoring DeclRefs in the request.

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira