Multiple authenticationMethods on RemoteUserLoginHandler

[Howes, Nick]

Hi,

I'm configuring my RemoteUserLoginHandler to support both Password and PasswordProtectedTransport authentication context classes instead of the default "unspecified", because an unconfigurable SP is making a request for a Password based handler and it obviously doesn't match the intended handler otherwise. The PasswordProtectedTransport is in there since that's the preferred default that I've specified in my relying party config.

This appears to work fine for this SP and for existing SPs that don't specify an authentication context class. Then I read this in the documentation:

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUserAuthn
"A note about the built-in handlers: for security reasons, the handlers are configured to cross-check that the method they supply to the user's session matches the method that an SP asked for. This results in a limitation for the built-in handlers such that they support only a single method type in a given configuration, rather than allowing for more than one at a time. A custom login handler can circumvent this limitation by supporting multiple methods at the same time (even if those methods are really just different ways of expressing the same underlying behavior by the handler). This is important for scenarios in which different SPs are expressing or expecting different values for the same underlying mechanism."

This suggests that I shouldn't be doing this with a built-in handler. But I can't see anything special in the source for the built in login handlers that might do this cross-checking, added the fact that it appears to work fine. Am I actually doing something bad or is the documentation out of date?

Thanks
Nick


-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20130726/6e5c0b81/attachment.html