WebAuthn: Issue with Fido metadata?

[Cantor, Scott]

> Maybe I don't quite understand. Isn't the activateCondition 
> implemented on the idp side? The condition I use is that if
> the user has a passkey then the authn/Password can not be
> used (i.e. not downgrading). That check is done on the idp
> side as I understand.

Of course.

> If the SP requires MFA and gets only authn/Password (if the
> user hasn't a passkey) then the request will be rejected
> anyway. Am I correct?

A correctly configured IdP doesn't lie, and no IdP that isn't lying should be signalling an AuthnContext class signalling something in particular if it wasn't done.

An SP that doesn't request a specific context class doesn't get to complain about what it gets or what was done.

So generally, yes, worrying about a downgrade means you don't have effective use of SAML to enforce what's being done.

-- Scott