Bug in handling user certifications for specific contexts?

[Cantor, Scott]

On 9/9/15, 11:41 AM, "dev on behalf of Tom Scavo" <dev-bounces at shibboleth.net on behalf of trscavo at internet2.edu> wrote:

>On Wed, Sep 9, 2015 at 11:22 AM, Wessel, Keith <kwessel at illinois.edu> wrote:
>>
>> Is there anything that can be done (or added) to tell a flow to first run another flow to get the needed principal before proceeding?
>
>I won't go so far as to suggest that what you're doing is wrong but
>recall that an SP can include a NameID in the AuthnRequest. I'm
>guessing this is precisely the use case that feature was intended to
>address.

The problem here is that it's *not* just about getting the user identity, it also involves assumptions that something login-related happened that isn't formally part of the login method in question. I think that's a problematic model in general that makes method selection based on complex rules very hard to get right.

The very fact that the Duo method is being configured to support the password SAML context class is a sign that something's wrong to me. I think to do that, the Duo method has to itself encompass use of passwords at the end of the day.

>Btw, including a NameID in the AuthnRequest is the precise definition
>of "Step-Up Authentication."

Well, I don't think SAML has such a concept, but that's one component (which nothing much but Shibboleth implements, and really only at the IdP at that) that could be used to implement it.

-- Scott