OpenID authentication context

[Cantor, Scott]

On 5/30/12 2:57 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
>
>>Currently I fabricated the following name, and this doesn't exist as far
>>as I can tell, but it worked to link the two sides:
>>urn:oasis:names:tc:SAML:2.0:ac:classes:OpenID
>>
>>I've also considered using some real ones such as:
>>urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol
>
>You shouldn't use either, you don't control that namespace.

Sorry, I missed the second being an existing one. No, that one is intended
to mean authenticated by IP address, I would think. None of the existing
classes in 2.0 would be applicable to a separate SSO protocol.

However, one school of thought is that it's really up to the
authentication itself at the OP. Which is probably password. But of
course, then you can't request it, so the presumption is that it's
something else. But you can see this is very messy very fast and
inherently lossy.

I think my opinion is that it's a matter for the IdP to offer this choice
of authentication, and up to the attributes you assert to give the SP the
means to distinguish cases, not something you want an SP requesting
explicitly. Even if I disagree with 800-63 about, well, a lot, I do think
that using a notion like assurance as an abstraction in place of specific
technology indicators is a stronger model. It's the definition of
assurance that gets messy, but it's still a better theory.

-- Scott