<html><head></head><body><div style="color:#000; background-color:#fff; font-family:HelveticaNeue, Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"><div id="yui_3_16_0_1_1454676233632_6756"> Hi, </div><div id="yui_3_16_0_1_1454676233632_6758"><br></div><div id="yui_3_16_0_1_1454676233632_6760" dir="ltr">I am working on a requirement supporting a MFA case using Shibboleth IDP where the relying party wants IDP to include all the authentication methods in the multiple AuthnContextClassRef elements such as:</div><div id="yui_3_16_0_1_1454676233632_6792" dir="ltr"><br></div><div id="yui_3_16_0_1_1454676233632_6831" dir="ltr"></saml2:AuthnStatement></div><div id="yui_3_16_0_1_1454676233632_6890" dir="ltr"> </saml2:AuthnContext>></div><div id="yui_3_16_0_1_1454676233632_6892" dir="ltr"> <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef></div><div id="yui_3_16_0_1_1454676233632_6903" dir="ltr"><saml2:AuthnContext></div><div id="yui_3_16_0_1_1454676233632_6901" dir="ltr"><saml2:AuthnStatement AuthnInstant="2014-06-10T12:32:29.263Z"><br id="yui_3_16_0_1_1454676233632_6841"></saml2:AuthnStatement></div><div id="yui_3_16_0_1_1454676233632_6936" dir="ltr"></saml2:AuthnContext>></div><div id="yui_3_16_0_1_1454676233632_6938" dir="ltr"><saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken</saml2:AuthnContextClassRef></div><div id="yui_3_16_0_1_1454676233632_6940" dir="ltr"><saml2:AuthnContext></div><div id="yui_3_16_0_1_1454676233632_6951" dir="ltr"><saml2:AuthnStatement AuthnInstant="2014-06-10T12:32:29.263Z"></div><div id="yui_3_16_0_1_1454676233632_6980" dir="ltr"><br></div><div id="yui_3_16_0_1_1454676233632_6978" dir="ltr">I have built an authn flow extension in IDP 3.2.1 to put multiple principals into the subject object of the AuthenticationResult. But in the end, only one of the principals is returned in the response. Looking at the document for RequestedPrincipalContext, it says "After successful authentication, this context also contains a custom
Principal produced by the authentication process that actually matched
the specified requirements. In SAML terms, this is what will end up in
the assertion's AuthnContext element". Looking at the RequestedPrincipalContext class, it allows to set only one matching principal even if there are multiple requested principals in the RequestedPrincipalContext object. </div><div id="yui_3_16_0_1_1454676233632_7093" dir="ltr"><br></div><div id="yui_3_16_0_1_1454676233632_7091" dir="ltr">So my question is that is there a hook that I can extend IDP to allow multiple principals to be included as AuthnContextClassRef in the Saml response?</div><div id="yui_3_16_0_1_1454676233632_7108" dir="ltr"><br></div><div id="yui_3_16_0_1_1454676233632_7106" dir="ltr">Thanks a lot.</div><div id="yui_3_16_0_1_1454676233632_7104" dir="ltr"><br></div><div id="yui_3_16_0_1_1454676233632_7102" dir="ltr">Joey</div></div></body></html>