Configuring IdP v.2.3.8 with Silver assurance

[Terry Fleury]

Hello,

To date, I have been using Shibboleth IdP software v.2.2.1 on my test 
IdP. The IdP is configured to use the UsernamePassword <LoginHandler> 
backed by JAAS/Kerberos authentication. To get it to also use silver 
assurance, I added an <AuthenticationMethod> statement in the 
<LoginHandler> as follows:

<ph:LoginHandler xsi:type="ph:UsernamePassword"
jaasConfigurationLocation="file:///opt/shibboleth-idp/conf/login.config">
  <ph:AuthenticationMethod>http://id.incommon.org/assurance/silver</ph:AuthenticationMethod>
  <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod>
</ph:LoginHandler>

I also added an <Extensions> section to the IdP metadata with the 
appropriate <AttributeValue> for silver.

This works fine for IdP v.2.2.1. I can request silver from my test SP 
and the test IdP returns it when I log in with username/password.

A similar configuration does NOT work for IdP v.2.3.8. When my test SP 
requests silver, I get the following error in the idp-process.log file:

10:21:01.565 - ERROR 
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:529] 
- Relying patry required an authentication method of 
[http://id.incommon.org/assurance/silver] but the login handler 
performed urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
10:21:01.576 - ERROR 
[edu.internet2.middleware.shibboleth.idp.authn.AuthenticationEngine:563] 
- Authentication failed with the error:
edu.internet2.middleware.shibboleth.idp.authn.AuthenticationException: 
Relying patry required an authentication method of 
[http://id.incommon.org/assurance/silver] but the login handler 
performed urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport

If the test SP does not request Silver, the test IdP gives 
PasswordProtectedTransport as expected and the SP succeeds.

I understand IdP v.2.3.x is more particular with placement of 
configuration options. So how can I make IdP v.2.3.8 act like v.2.2.1, 
i.e., return silver assurance when requested from the SP?

Thank you for your help.

Terry Fleury
tfleury at illinos.edu