expressing AuthnContextClassRef as an attribute

[Cantor, Scott]

On 7/24/15, 4:26 PM, "users on behalf of David Langenberg" <users-bounces at shibboleth.net on behalf of davel at uchicago.edu> wrote:

>I have an SP asking for AuthnContextClassRef as an attribute (of course encoded with their own local encoding).  Any thoughts on how to turn that particular part of the response into an attribute?

I'm not sure which end we're talking about. You mean at the IdP (and I assume v3)? That field doesn't exist at the time any attribute logic is running (and it obvbiously doesn't exist at all in SAML 1).

The custom Principal objects in the authenticated subject are where it comes from. If the RequestedPrincipalContext contains a matchingPrincipal, that's what gets used, assuming it's of an appropriate type. If not, an injected function [1] is used to determine it.

The SAML 2 action is [2]. The SAML 1 action is [3].

So in short, you would have to duplicate all that in a script to do it in the resolver and count on it not changing, though it can't really change fundamentally without altering behavior. It's not something I would advise obviously. The injected function used is part of the API though.


-- Scott

[1] net.shibboleth.idp.authn.principal.DefaultPrincipalDeterminationStrategy
[2] net.shibboleth.idp.saml.saml2.profile.impl.AddAuthnStatementToAssertion
[3] net.shibboleth.idp.saml.saml1.profile.impl.AddAuthenticationStatementToAssertion