Multiple authenticationMethods on RemoteUserLoginHandler

[Cantor, Scott]

On 7/26/13 8:31 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:
>
>>This appears to work fine for this SP and for existing SPs that don't
>>specify an authentication context class.
>
>It will work with any SP that doesn't specify something other than the one
>it's configured to return.

A key point, useful for the archives: configuring the
defaultAuthenticationMethod setting in relying-party.xml isn't the same as
"requesting a method" in SAML terms. There's no cross-checking implemented
in the former case, that just tells the IdP which of possibly more than
one handler to use for a generic request from a particular RP, but doesn't
involve SAML spec behavior controlling the limiting of methods based on
the SAML request. That only runs when the SP actually includes a
RequestedAuthnContext element in its message.

That's fairly non-obvious (to me at least).

-- Scott