the Comparison XML attribute

[Cantor, Scott]

On 7/11/12 12:14 PM, "Tom Scavo" <trscavo at gmail.com> wrote:

>Does the Shibboleth SP support the Comparison attribute in the
>AuthnRequest?

Support in the sense you can get it to be sent, yes, there's an
authnContextComparison content setting.

> What will the IdP do if such an attribute is included in
>the AuthnRequest? In particular, how will it respond to
>Comparison="exact" (which is the default, I know)?

That's the only mode the IdP supports in any sense. I did my best to get
the documentation on how method selection works cleaned up in the wiki a
few weeks ago.

>The reason I ask is that the ICAM SSO profile *requires*
>Comparison="exact" in the AuthnRequest. I have no idea why, but there
>you have it.

They probably had cases where IdPs were falling over if it was defaulted.
They required exact because they know nothing else has much if any support.

-- Scott