SP stopped working after IDP upgraded to 3.1.1

[Cantor, Scott]

On 4/7/15, 10:45 AM, "Hong Ye" <hy93 at cornell.edu> wrote:

>Hi,I upgraded our test IDP to 3.1.1.

What was it running before?

> During testings, I found one SP stopped working while others worked fine. No error or warning in idp-process.log. There is info level message showing "None of the potential authentication flows can satisfy the request”. Is this something I can fix in IDP configuration or it has to be fixed in SP? This SP worked fine before the upgrade.

The IdP is not going to handle a request for this out of the box:

>    <samlp:RequestedAuthnContext xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
>                                 Comparison="minimum"
>                                 >
>        <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef>
>    </samlp:RequestedAuthnContext>

Shibboleth sees that as undefined ayway, but it probably could be made to do something with it.

Until I know what you were running and what you think broke it, I'm not going to speculate any further, but no SP should be asking for that.

-- Scott