Custom authentication handlers and RequestedAuthnContext ordering

[Cantor, Scott]

On 10/3/12 12:05 PM, "Stevens,Lee F" <cro at ufl.edu> wrote:
>
>I'm developing a custom authentication handler for implementing InCommon
>silver and bronze authn context classes. But, I'm having a problem when
>the IdP receives
> a '<RequestedAuthnContext Comparison="exact">' . The IdP software
>appears to be not respecting that the list is ordered, and it's routing
>me to the first matching AuthnContext class in the IdP's internal handler
>list, even if there's a better match listed earlier in the
>RequestedAuthnContext part of the request.

It does not respect the ordering, but a custom handler bound to several
methods can do its own examinination of the request to determine what
order was requested and then internally adjust its behavior. As long as
the method returned to the engine is contained in the set requested by the
SP, it should accept that result back.

The code in the engine is brittle, and however it works at the moment,
that's how it's staying. It's too dangerous to try and "fix" or enhance
it, and we're not planning to do so. Enhancing all of that is a primary
goal for future versions.

-- Scott