MCB "configuration" per SP

[Scott Koranda]

Hello,

The MCB can be configured to use an attribute to determine which
authentication contexts are allowed for a user, ie.

<idms attributeResolverID="allowedAuthContexts" />

Further the attribute can be of type "Script" and have a dependency on
other attributes such as the value of isMemberOf from an LDAP query on
the principal.

Still further, the script can ascertain the SP by making a call to

peerEntityId = String(requestContext.getPeerEntityId());

Is it not the case then the logic in the scripted
"allowedAuthContexts" attribute can be such that it can make a
decision on which authentication contexts be allowed for a user by
combining the user's LDAP record and the entityID of the SP which the
user is attempting to access?

The mechanism described above would allow for a per-SP/per-user
"configuration", though admittedly it is not particularly elegant.

Am I missing something? It appears to work well with my sandbox.

I should add that I am primarily focused on SPs that do not send an
explicit request for authentication contexts.

Thanks,

Scott K