Limiting admin identities to selected SPs

[Tom Scavo]

On Mon, Jun 3, 2013 at 5:40 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>
> Excluding data from a Success response is a much more straightforward way to support an application's error handling then using a status code.

What about AuthnContext? From section 3.3.2.2.1 of SAML2 Core:

"If none of the specified classes or declarations can be satisfied in
accordance with the rules below, then the responder MUST return a
<Response> message with a top-level <StatusCode> of
urn:oasis:names:tc:SAML:2.0:status:Responder and MAY return a
second-level <StatusCode> of
urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext."

Is that the expected behavior and can your SP handle it?

Thanks,

Tom