<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0">
<base href="https://issues.shibboleth.net/jira">
<title>Message Title</title>
</head>
<body class="jira" style="color: #333333; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.429">
<table id="background-table" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; background-color: #f5f5f5; border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt" bgcolor="#f5f5f5">
<!-- header here -->
<tbody>
<tr>
<td id="header-pattern-container" style="padding: 0px; border-collapse: collapse; padding: 10px 20px">
<table id="header-pattern" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td id="header-avatar-image-container" valign="top" style="padding: 0px; border-collapse: collapse; vertical-align: top; width: 32px; padding-right: 8px" width="32"> <img id="header-avatar-image" class="image_fix" src="cid:jira-generated-image-avatar-3639505b-5fd6-47b7-a87e-f5ba01f0b435" height="32" width="32" border="0" style="border-radius: 3px; vertical-align: top"> </td>
<td id="header-text-container" valign="middle" style="padding: 0px; border-collapse: collapse; vertical-align: middle; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px"> <a class="user-hover" rel="cphillips@canarie.ca" id="email_cphillips@canarie.ca" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=cphillips%40canarie.ca" style="color:#0052cc;; color: #3b73af; text-decoration: none">Chris Phillips</a> <strong>commented</strong> on <a href="https://issues.shibboleth.net/jira/browse/IDP-1728" style="color: #3b73af; text-decoration: none"><img src="cid:jira-generated-image-avatar-bfc75064-ed40-470c-87bf-253aa8c8c0e0" height="16" width="16" border="0" align="absmiddle" alt="New Feature"> IDP-1728</a> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="email-content-container" style="padding: 0px; border-collapse: collapse; padding: 0 20px">
<table id="email-content-table" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; border-spacing: 0; border-collapse: separate">
<tbody>
<tr>
<!-- there needs to be content in the cell for it to render in some clients -->
<td class="email-content-rounded-top mobile-expand" style="padding: 0px; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 15px; background-color: #ffffff; border-left: 1px solid #cccccc; border-top: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom: 0; border-top-right-radius: 5px; border-top-left-radius: 5px; height: 10px; line-height: 10px; padding: 0 15px 0 16px; mso-line-height-rule: exactly" height="10" bgcolor="#ffffff"> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table class="page-title-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td style="vertical-align: top;; padding: 0px; border-collapse: collapse; padding-right: 5px; font-size: 20px; line-height: 30px; mso-line-height-rule: exactly" class="page-title-pattern-header-container"> <span class="page-title-pattern-header" style="font-family: Arial, sans-serif; padding: 0; font-size: 20px; line-height: 30px; mso-text-raise: 2px; mso-line-height-rule: exactly; vertical-align: middle"> <a href="https://issues.shibboleth.net/jira/browse/IDP-1728" style="color: #3b73af; text-decoration: none">Re: Add support for mapping proxied Attribute into issued AuthnContext</a> </span> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="text-paragraph-pattern-top" class="email-content-main mobile-expand comment-top-pattern" style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; border-bottom: none; padding-bottom: 0" bgcolor="#ffffff">
<table class="text-paragraph-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 2px">
<tbody>
<tr>
<td class="text-paragraph-pattern-container mobile-resize-text " style="padding: 0px; border-collapse: collapse; padding: 0 0 10px 0"> <p style="margin: 10px 0 0 0; margin-top: 0">Thanks for tracking this a few days ago. I was going to add this in as an RFE and will tag on to this as 'yes, this please.'</p> <p style="margin: 10px 0 0 0">For more detail:</p> <p style="margin: 10px 0 0 0">When an additional factor is used in Azure AD, the claim '<a href="http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod'" class="external-link" target="_blank" rel="nofollow noopener" style="color: #3b73af; text-decoration: none">http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod'</a></p> <p style="margin: 10px 0 0 0">is set to Value = "http://schemas.microsoft.com/claims/multipleauthn"</p> <p style="margin: 10px 0 0 0"> </p> <p style="margin: 10px 0 0 0">The desire is to ingest this claim during proxying practice and then adjust the AuthNContext accordingly.</p> <p style="margin: 10px 0 0 0">A mapping table of attributes,their values, and transitions to which context would be useful to permit things being adjusted.</p> <p style="margin: 10px 0 0 0">It may also be useful to signal that the authentication context is being materially changed somehow as a way to instrument or diagnose the behaviour to ensure it's in alignment with expectations and testing.</p> <p style="margin: 10px 0 0 0"> </p> <p style="margin: 10px 0 0 0">While these two links are for adfs, they lend insight to the MFA/practices around additional factors:</p> <p style="margin: 10px 0 0 0"><a href="https://docs.microsoft.com/en-us/archive/blogs/ramical/under-the-hood-tour-on-multi-factor-authentication-in-adfs-part-1-policy" class="external-link" target="_blank" rel="nofollow noopener" style="color: #3b73af; text-decoration: none">https://docs.microsoft.com/en-us/archive/blogs/ramical/under-the-hood-tour-on-multi-factor-authentication-in-adfs-part-1-policy</a></p> <p style="margin: 10px 0 0 0">and</p> <p style="margin: 10px 0 0 0"><a href="https://www.enowsoftware.com/solutions-engine/ad-fs-claims-rules-and-modern-authentication" class="external-link" target="_blank" rel="nofollow noopener" style="color: #3b73af; text-decoration: none">https://www.enowsoftware.com/solutions-engine/ad-fs-claims-rules-and-modern-authentication</a></p> <p style="margin: 10px 0 0 0"> </p> <p style="margin: 10px 0 0 0">Forward looking, if inbound requests could be OIDC (plausible?) the technique to observe/ingest the inbound OIDC claim may be useful as well but by no means necessary for this feature request. </p> <p style="margin: 10px 0 0 0">It appears the OIDC there may be value in techniques to ingest the 'acr' claim and it's value :</p> <p style="margin: 10px 0 0 0"><a href="https://openid.net/specs/openid-connect-core-1_0.html#acrSemantics" class="external-link" target="_blank" rel="nofollow noopener" style="color: #3b73af; text-decoration: none">https://openid.net/specs/openid-connect-core-1_0.html#acrSemantics</a></p> <p style="margin: 10px 0 0 0">**<a href="https://openid.net/specs/openid-connect-modrna-authentication-1_0.html#acr_values" class="external-link" target="_blank" rel="nofollow noopener" style="color: #3b73af; text-decoration: none">https://openid.net/specs/openid-connect-modrna-authentication-1_0.html#acr_values</a></p> <p style="margin: 10px 0 0 0"><a href="https://stackoverflow.com/questions/52632690/can-someone-explain-acr-return-values-in-oidc" class="external-link" target="_blank" rel="nofollow noopener" style="color: #3b73af; text-decoration: none">https://stackoverflow.com/questions/52632690/can-someone-explain-acr-return-values-in-oidc</a></p> <p style="margin: 10px 0 0 0">While I'm really reaching on this part, I wanted to bring it up if it influences the design/implementation decisions.</p> <p style="margin: 10px 0 0 0"> </p> <p style="margin: 10px 0 0 0">Thanks for tracking this item. the Azure AD SAML claims influencing the outbound Shib IDP claim is key. An inbound OIDC use of acr and influencing outbound SAML proxied claim is entirely optional.</p> <p style="margin: 10px 0 0 0"> </p> <p style="margin: 10px 0 0 0"> </p> <p style="margin: 10px 0 0 0"> </p> <p style="margin: 10px 0 0 0"> </p> <p style="margin: 10px 0 0 0"> </p> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table id="actions-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px">
<tbody>
<tr>
<td id="actions-pattern-container" valign="middle" style="padding: 0px; border-collapse: collapse; padding: 10px 0 10px 24px; vertical-align: middle; padding-left: 0">
<table align="left" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td class="actions-pattern-action-icon-container" style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 0; vertical-align: middle"> <a href="https://issues.shibboleth.net/jira/browse/IDP-1728#add-comment" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none"> <img class="actions-pattern-action-icon-image" src="cid:jira-generated-image-static-comment-icon-d4654337-6cab-4708-9577-695ebd97c884" alt="Add Comment" title="Add Comment" height="16" width="16" border="0" style="vertical-align: middle"> </a> </td>
<td class="actions-pattern-action-text-container" style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 4px; padding-left: 5px"> <a href="https://issues.shibboleth.net/jira/browse/IDP-1728#add-comment" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none">Add Comment</a> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table> </td>
</tr>
<!-- there needs to be content in the cell for it to render in some clients -->
<tr>
<td class="email-content-rounded-bottom mobile-expand" style="padding: 0px; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 5px; line-height: 5px; background-color: #ffffff; border-top: 0; border-left: 1px solid #cccccc; border-bottom: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; mso-line-height-rule: exactly" height="5" bgcolor="#ffffff"> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="footer-pattern" style="padding: 0px; border-collapse: collapse; padding: 12px 20px">
<table id="footer-pattern-container" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td id="footer-pattern-text" class="mobile-resize-text" width="100%" style="padding: 0px; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px"> This message was sent by Atlassian Jira <span id="footer-build-information">(v8.5.4#805004-<span title="0444eab799707f9ad7b248d69f858774aadfd250" data-commit-id="0444eab799707f9ad7b248d69f858774aadfd250}">sha1:0444eab</span>)</span> </td>
<td id="footer-pattern-logo-desktop-container" valign="top" style="padding: 0px; border-collapse: collapse; padding-left: 20px; vertical-align: top">
<table style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td id="footer-pattern-logo-desktop-padding" style="padding: 0px; border-collapse: collapse; padding-top: 3px"> <img id="footer-pattern-logo-desktop" src="https://issues.shibboleth.net/jira/images/mail/atlassian-email-logo.png" alt="Atlassian logo" title="Atlassian logo" width="191" height="24" class="image_fix"> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table>
</body>
</html>