Silently try more then one login handler with UnsolicitedSSO

[Cantor, Scott]

On 4/30/13 1:40 PM, "Henry B. Hotz" <hotz at jpl.nasa.gov> wrote:
>
>I don't think my approach gives me enough control to provide the right
>user experience.  OTOH, I'm not sure what the right user experience
>*should* be in the face of multiple, valid authentication methods.  The
>Kerberos-based expectation would be that the user never sees the IdP at
>all, but that prevents the user from using, e.g. a smart card.

Well, I think the point is that if an SP doesn't ask for what it wants,
then it needs to accept what it gets, and if it asks for something that
isn't technology-specific (like an LOA), then it needs to accept that LOA
and stop trying to dictate technology.

If people want to care about methods again, then the 800-63 nonsense needs
to stop and we'll go back to the original model of talking about
technology.

>Maybe I'm overthinking it?  NIST 800-63 says SAML is only LoA 3, even if
>it required an LoA 4 smart card initially.

Bearer is LOA 3 only. I think Holder of Key might be LOA 4, but I don't
remember (and it's moot in this context).

-- Scott