OpenID authentication context

[Cantor, Scott]

On 5/30/12 5:09 PM, "Tom Scavo" <trscavo at gmail.com> wrote:

>On Wed, May 30, 2012 at 3:06 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>>
>> However, one school of thought is that it's really up to the
>> authentication itself at the OP. Which is probably password.
>
>Ah, but it could be Google 2-Step, so it's not so easy.

It isn't, really, given their adoption rate, but yes, that¹s the point. It
gets very, very messy when you actually annotate the account with local
IdP data, because then you really have two IdPs.

The way this was intended to work, now that it's swapped in, is that your
IdP is a proxy, and you have an AC class that references how
authentication at the original OP was done, and then you carry an
identifier for that OP in an element called AuthenticatingAuthority.

And the SP can influence how that happens using Proxy-related elements in
its AuthnRequest, rather than using AuthnContext.

The original use case for this was Passport, but the same theory applies
to OpenID.

-- Scott