Custom authentication handlers and RequestedAuthnContext ordering

[Stevens,Lee F]

Hello developers,

I'm developing a custom authentication handler for implementing InCommon silver and bronze authn context classes. But, I'm having a problem when the IdP receives a '<RequestedAuthnContext Comparison="exact">' . The IdP software appears to be not respecting that the list is ordered, and it's routing me to the first matching AuthnContext class in the IdP's internal handler list, even if there's a better match listed earlier in the RequestedAuthnContext part of the request. This is reflected by the fact that when I call getAttemptedAuthnMethod() in my login handler, it returns the wrong authncontextclass according to the semantics of RequestedAuthnContext and comparison='exact'.

My question is - is getAttemptedAuthnMethod() the correct way to lookup the resolved/idp-determined authncontextclass in my custom login handler? Does the IdP respect the order of the methods in a RequestedAuthnContext  list of AuthnContextClassRef elements that comprise a SAML authn request?

I'm attaching the AuthnRequest and some DEBUG level output from the IdP.

Thanks
Lee

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/dev/attachments/20121003/c8c36478/attachment.html 
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: idp-process-log.txt
Url: http://shibboleth.net/pipermail/dev/attachments/20121003/c8c36478/attachment.txt 
-------------- next part --------------
An embedded and charset-unspecified text was scrubbed...
Name: authnrequest.txt
Url: http://shibboleth.net/pipermail/dev/attachments/20121003/c8c36478/attachment-0001.txt