Silently try more then one login handler with UnsolicitedSSO

[Henry B. Hotz]

On Apr 30, 2013, at 10:48 AM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

> If people want to care about methods again, then the 800-63 nonsense needs
> to stop and we'll go back to the original model of talking about
> technology.

(-: (-: (-: Yes, sir!! ;-) ;-) ;-)

>> Maybe I'm overthinking it?  NIST 800-63 says SAML is only LoA 3, even if
>> it required an LoA 4 smart card initially.
> 
> Bearer is LOA 3 only. I think Holder of Key might be LOA 4, but I don't
> remember (and it's moot in this context).

Correct.  NASA has a nice writeup of their interpretation somewhere.  They say you can declare LoA 4 if you use the card for both the IdP connection and the SP connection, *AND* the SP verifies that the TLS client cert matches the client identity in the SAML assertion.

I'll shut up now.  ;-)

------------------------------------------------------
The opinions expressed in this message are mine,
not those of Caltech, JPL, NASA, or the US Government.
Henry.B.Hotz at jpl.nasa.gov, or hbhotz at oxy.edu