expressing AuthnContextClassRef as an attribute

[David Langenberg]

On Sun, Jul 26, 2015 at 12:38 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 7/24/15, 4:26 PM, "users on behalf of David Langenberg" <
> users-bounces at shibboleth.net on behalf of davel at uchicago.edu> wrote:
>
> >I have an SP asking for AuthnContextClassRef as an attribute (of course
> encoded with their own local encoding).  Any thoughts on how to turn that
> particular part of the response into an attribute?
>
> I'm not sure which end we're talking about. You mean at the IdP (and I
> assume v3)? That field doesn't exist at the time any attribute logic is
> running (and it obvbiously doesn't exist at all in SAML 1).
>

Yep, I'm the IdP and yes, on v3.

The custom Principal objects in the authenticated subject are where it
> comes from. If the RequestedPrincipalContext contains a matchingPrincipal,
> that's what gets used, assuming it's of an appropriate type. If not, an
> injected function [1] is used to determine it.
>
> The SAML 2 action is [2]. The SAML 1 action is [3].
>
> So in short, you would have to duplicate all that in a script to do it in
> the resolver and count on it not changing, though it can't really change
> fundamentally without altering behavior. It's not something I would advise
> obviously. The injected function used is part of the API though.
>

Ok, yeah, gonna go tell this SP to go re-read the SAML spec and fix their
implementation to use the already-provided mechanisms for this.

Thanks

Dave


-- 
David Langenberg
Identity & Access Management Architect
The University of Chicago
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150726/36bc2455/attachment.html>