Mapping multi-context-broker.xml to Shibboleth IdPv3 Configuration

[David Walker]

I've posted a DRAFT document describing conversion from the
Multi-Context Broker (MCB) to IdPv3 at
https://wiki.shibboleth.net/confluence/x/oAEzAQ.  It's not yet complete,
and I'm sure it has errors, so I'd appreciate a glance from some more
knowledgeable eyes than mine.  You'll see some comments in red that are
open issues right now.

I also have some specific questions...

  * I believe IdPv3 bypasses the processing of authnContexts if the SP
    does not request any contexts.  Since one of the use cases is to
    allow institutions to require that certain people use multi-factor
    authentication (or allow users to opt-in to such a requirement), I'm
    looking for  a way to force that processing?  For example, is it
    possible to define a default relying party that "requests" the
    institution's lowest-level authnContext?
  * You'll notice that a number of the red comments are related to the
    MCB's ability to present the end user with a choice of feasible
    authentication methods, rather than picking one at random.  Scott, I
    have a memory that you said there was a hook that could be used to
    implement that choice mechanism; can you point me in the right
    direction?  I'm thinking it would be a "choice" flow that could be
    invoked after the IdP had determined the feasible flows that can be
    used, based on the SP's request and the user's allowable contexts. 
    The "choice" flow would then select which of the feasible flows to
    invoke, based on prompting the user or any other policy the site
    might want to implement.
  * Related to my previous question, does anyone have a use for
    presenting such a choice?  I thought it was important when spec'ing
    the MCB, but I've found that many sites go to lengths to turn it off.


Thanks

David

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150709/40dd3e14/attachment.html>