MCB & Webex

[Keith, Christopher]

Not sure if anyone who is using the MCB is also using Shibboleth with Webex.

Webex has an SSO configuration console and one of the options is
AuthnContextClassRef.

I have this configured to be:
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport

My MCB is configured to allow DUO to satisfy this context.

<context
name="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
method="passwordProtectedTransport">
   <allowedContexts>
      <context name="http://brown.edu/duo" />
   </allowedContexts>
</context>

 When I authenticate, my IDP generates an assertion with "
http://brown.edu/duo" as my authentication context.

Webex rejects this because it does not match the configured value.

When I looked closer at the authentication request, I noticed that Webex
does not actually include the configured AuthnContextClassRef in its
authentication request in a RequestedAuthnContext element.  In fact, it
does not include a RequestedAuthnContext element at all.

I am trying to figure out if this is a configuration issue on my part or an
implementation issue with Webex.

Thanks.

-- 
Christopher Keith '12 ScM
Associate Director
Integration & Identity Services
Computing and Information Services
Brown University
(401) 863-1153
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150205/7c2f12b7/attachment.html