step-up authentication

[Cantor, Scott]

On 10/13/13 2:27 PM, "Tom Scavo" <trscavo at internet2.edu> wrote:
>
>My question is: Can a Shib SP issue such an AuthnRequest? Asked
>another way, can the SP somehow map an incoming request to an email
>address and then issue the AuthnRequest shown above?

I'm not sure whether Subject is the appropriate way to do that, but no,
there is no support for the Subject element. There's no way to populate a
non-routine element in the request other than statically through a
template.

With the caveat of "not writing new code" of course.

In some cases you can put a script together that just generates its own
SAML request and use that in place of the SP, but that assumes you know
where the request should be sent. Not so nice for the general federated
case.

Note that absent signing and correlation of responses (the latter not
supported by the SP), passing something you mean to be "critical" to the
processing of the request at the IdP that doesn't itself get reflected
back to the SP in the assertion is unsafe. ForceAuthn, for example,
requiring the maxTimeSinceAuthn setting back at the other end.

So you'd have to get the Subject or an Attribute back containing the
matching address.

-- Scott