MCB and default authn context for an SP/RP in relying-party

[Caskey, Paul]

You can achieve the override functionality with a scripted attribute in your resolver - just block the user from being authorized for what the SP requested.



> -----Original Message-----
> From: users-bounces at shibboleth.net [mailto:users-
> bounces at shibboleth.net] On Behalf Of Michael A Grady
> Sent: Thursday, March 05, 2015 7:40 PM
> To: Shib Users
> Subject: Re: MCB and default authn context for an SP/RP in relying-party
> 
> 
> On Mar 5, 2015, at 4:34 PM, Paul Hethmon
> <paul.hethmon at clareitysecurity.com> wrote:
> 
> >
> >> On Mar 5, 2015, at 5:26 PM, Michael A Grady <mgrady at unicon.net>
> wrote:
> >>
> >> If I'm reading the following correctly:
> >>
> >> https://github.com/Internet2/Shibboleth-Multi-Context-
> Broker/issues/11
> >>
> >> it would appear that as of 1.2.1 (now at 1.2.2), the MCB added support for
> using the  default authn context for an SP/RP in the IdP's relying-party config
> file. Is that correct, and if so, in what situations? Only if the SP does not
> specify a context, or does this override/take precedence for that SP?
> >
> >
> > It's only used if the SP does not send a value.
> 
> Thanks for that. That's something, although personally, I think it should have
> overridden any value the SP sent, although I understand the debate around
> that. (I would have at least have it override if the requested context was any
> form of the password-only based contexts.)
> 
> 
> >
> > Paul
> >
> > -----
> > Paul Hethmon
> > Chief Software Architect
> > paul.hethmon at clareitysecurity.com
> 
> --
> Michael A. Grady
> Senior IAM Consultant, Unicon, Inc.
> 
> --
> To unsubscribe from this list send an email to users-
> unsubscribe at shibboleth.net