separating AuthenticationMethod contexts

[Cantor, Scott]

On 6/8/12 7:02 PM, "Russell Beall" <beall at usc.edu> wrote:
>
>It seems that when an SP does not request a particular authentication
>context, the IdP will use an existing one that is active, even if it is
>not specified as the default for the relying party in the
>relying-party.xml file.

I think that's true, yes. That's arguably a bug, or at least something
fairly subtle to document.

> Additionally, by default, I would expect one of these two
>AuthenticationMethods to be required when none is specified by the SP
>and/or no default is in the relying party file:
><ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:unspeci\fi
>ed</ph:AuthenticationMethod>
><ph:AuthenticationMethod>urn:oasis:names:tc:SAML:1.0:am:unspecified</ph:Au
>thenticationMethod>

Unspecified is not handled as a method, it's a string that means the
absence of a requirement.

-- Scott