separating AuthenticationMethod contexts

[Cantor, Scott]

On 6/11/12 9:58 AM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>On 6/8/12 7:02 PM, "Russell Beall" <beall at usc.edu> wrote:
>>
>>It seems that when an SP does not request a particular authentication
>>context, the IdP will use an existing one that is active, even if it is
>>not specified as the default for the relying party in the
>>relying-party.xml file.
>
>I think that's true, yes. That's arguably a bug, or at least something
>fairly subtle to document.

Was just chatting about it. At the moment, the conclusion is "as intended"
but it is a subtle thing. The default method is being used only for
initial selection of a handler to use in the absence of a requirement, not
as a limiting filter on methods for a given SP.

So that means what you're trying to do can't be accomplished with the
built-in behavior for PreviousSession and would require a custom login
handler. I use previous session as an optimization, for example, but I
could remove it and I'd still have SSO if I wanted full control over the
methods to honor.

-- Scott