AuthN Context Class in PRC?

[Cantor, Scott]

> Trying to figure out few things in the PRC:

I alluded to the need to get this documented for authentication in another note, it's on my list.

> 1.       What is the context class in the PRC that dictates the requested
> authentication context class? "RequestedPrincipalContext"?

Yes, correct. That is technology neutral, not SAML aware.

> 2.       Assuming that is true, could I stuff an instance of that context into the
> PRC, and then have the IDP honor it in downstream flows?

There is logic in the flows that populates that context, and in most cases it would just be overwritten depending on when you did it.

To address IDP-921, I have to analyze that behavior so that might change. It might be an option to just have those actions do nothing if the context already exists.

> 3.       On the outbound call, what is the context in PRC that indicates what was satisfied?

The AuthenticationResult is what tells the system what was done, and eventually that gets cross-checked against the RequestedPrincipalContext to make sure the result's Principals satisfy the context if it exists, but that's handled by the authentication flow.

The Principal that was found to "match" is cached in the matchingPrincipal property of the RequestedPrincipalContext, and in SAML, the AuthenticationMethod and AuthnContext are populated based on an injected function that first pulls from that field. That's my recollection anyway.

-- Scott