MCB & Webex

[David Langenberg]

If WebEx is not sending a RequestedAuthnContext then it should not try to
enforce a value returned in the SAMLResponse.  I have this same problem
with research.gov.  My advice is to either find some way for WebEx to
request PasswordProtectedTransport or remove the check for
PasswordProtectedTransport.

Dave

On Thu, Feb 5, 2015 at 3:10 PM, Keith, Christopher <
christopher_keith at brown.edu> wrote:

> Not sure if anyone who is using the MCB is also using Shibboleth with
> Webex.
>
> Webex has an SSO configuration console and one of the options is
> AuthnContextClassRef.
>
> I have this configured to be:
> urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
>
> My MCB is configured to allow DUO to satisfy this context.
>
> <context
> name="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
> method="passwordProtectedTransport">
>    <allowedContexts>
>       <context name="http://brown.edu/duo" />
>    </allowedContexts>
> </context>
>
>  When I authenticate, my IDP generates an assertion with "
> http://brown.edu/duo" as my authentication context.
>
> Webex rejects this because it does not match the configured value.
>
> When I looked closer at the authentication request, I noticed that Webex
> does not actually include the configured AuthnContextClassRef in its
> authentication request in a RequestedAuthnContext element.  In fact, it
> does not include a RequestedAuthnContext element at all.
>
> I am trying to figure out if this is a configuration issue on my part or
> an implementation issue with Webex.
>
> Thanks.
>
> --
> Christopher Keith '12 ScM
> Associate Director
> Integration & Identity Services
> Computing and Information Services
> Brown University
> (401) 863-1153
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
David Langenberg
Identity & Access Management
The University of Chicago
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150205/d5d04212/attachment.html