Update Re: Requested PasswordProtectedTransport auth context & MCB

[IAM David Bantz]

Closing the loop:

The changes I described here seem to work to enable those without an
explicit directory based allowed authN context to use password method to
satisfy the SP requested PPT context.

On Tue, Jul 7, 2015 at 5:27 PM, IAM David Bantz <dabantz at alaska.edu> wrote:

> I'm starting to understand. Sorry to be a slow learner. I see that my MCB
> is configured to allow initial authN to pass through provided the SP
> doesn't have a requested context:
>
>    <principalAuthnContextRequired>false</principalAuthnContextRequired>
>
> So I'm encountering my problem when the new SP requires PPT that I
> normally don't see because of that config.
>
>
> I'm drawing users' authNcontexts from a mapped directory attribute (group
> membership).
>
> So ... I should be able to add something like this to that resolver:
>
>         <DefaultValue>urn:oasis:names:tc:SAML:2.0:ac:classes:
> PasswordProtectedTransport</DefaultValue>
> to provide an allowed authNcontext for (most) users with no other context
> explicitly named.
>
> Combined with the following to enable password to satisfy requested PPT.
>
>      <context name="urn:oasis:names:tc:SAML:2.0:ac:classes:Password"
> method="password">
>             <allowedContexts>
>                 <context name="https://iam.alaska.edu/trac/wiki/mfa" />
>                 <context name="urn:oasis:names:tc:SAML:2.0:ac:classes:
> PasswordProtectedTransport" />
>             </allowedContexts>
>
>     </context>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150708/5feaa454/attachment.html>