step-up authentication

[Leif Johansson]

On 10/13/2013 08:27 PM, Tom Scavo wrote:
> I'm writing a profile for step-up authentication where an SP sends the
> following AuthnRequest to the IdP:
>
> <samlp:AuthnRequest ...>
>  <saml:Issuer>https://sp.example.com/SAML2</saml:Issuer>
>  <saml:Subject>
>    <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">
>      user at example.org
>    </saml:NameID>
>  </saml:Subject>
>  <samlp:NameIDPolicy AllowCreate="false"/>
>  <samlp:RequestedAuthnContext>
>    <saml:AuthnContextClassRef>
>      http://example.org/authncontextclass/duo-mobile
>    </saml:AuthnContextClassRef>
>  </samlp:RequestedAuthnContext>
> </samlp:AuthnRequest>
>
> As a result, the IdP prompts the user for a one-time passcode (OTP).
> The user generates an OTP on their mobile device and enters it at the
> prompt. The IdP validates the OTP using the email address in the
> AuthnRequest (which was previously bound to the mobile device).
>
> My question is: Can a Shib SP issue such an AuthnRequest? Asked
> another way, can the SP somehow map an incoming request to an email
> address and then issue the AuthnRequest shown above?
>
> Thanks,
>
> Tom
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
Why do you want to be technology-dependent?