step-up authentication

[Tom Scavo]

On Sun, Oct 13, 2013 at 2:52 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> On 10/13/13 2:27 PM, "Tom Scavo" <trscavo at internet2.edu> wrote:
>>
>>My question is: Can a Shib SP issue such an AuthnRequest? Asked
>>another way, can the SP somehow map an incoming request to an email
>>address and then issue the AuthnRequest shown above?
>
> I'm not sure whether Subject is the appropriate way to do that

Seems right to me, but you were present when the spec was
written...what was the intended use case for a Subject in an
AuthnRequest?

> but no,
> there is no support for the Subject element. There's no way to populate a
> non-routine element in the request other than statically through a
> template. With the caveat of "not writing new code" of course.

Okay, that's what I thought since I couldn't find anything along these
lines in the wiki.

> In some cases you can put a script together that just generates its own
> SAML request and use that in place of the SP, but that assumes you know
> where the request should be sent. Not so nice for the general federated
> case.

Understood. In my case, there is no discovery since there's a single
IdP that performs all step-up authentication, so an external script is
a possibility.

> Note that absent signing and correlation of responses (the latter not
> supported by the SP), passing something you mean to be "critical" to the
> processing of the request at the IdP that doesn't itself get reflected
> back to the SP in the assertion is unsafe. ForceAuthn, for example,
> requiring the maxTimeSinceAuthn setting back at the other end.
>
> So you'd have to get the Subject or an Attribute back containing the
> matching address.

Yes, I think SAML Core is clear about this, which is why I was hoping
to use the Shib SP. This causes me to ask a somewhat different
question, however: If the script included a RelayState value in the
request, could the SP be induced to leverage the RelayState value upon
return to validate the response to contain a strongly matching
subject?

Tom