MCB and default authn context for an SP/RP in relying-party

[Michael A Grady]

On Mar 5, 2015, at 9:01 PM, Caskey, Paul <pcaskey at utsystem.edu> wrote:

> You can achieve the override functionality with a scripted attribute in your resolver - just block the user from being authorized for what the SP requested.

Or I could patch the MCB to make it an override. But accomplishing it thru config rather than code would have been nice.

> 
> 
> 
>> -----Original Message-----
>> From: users-bounces at shibboleth.net [mailto:users-
>> bounces at shibboleth.net] On Behalf Of Michael A Grady
>> Sent: Thursday, March 05, 2015 7:40 PM
>> To: Shib Users
>> Subject: Re: MCB and default authn context for an SP/RP in relying-party
>> 
>>>> it would appear that as of 1.2.1 (now at 1.2.2), the MCB added support for
>> using the  default authn context for an SP/RP in the IdP's relying-party config
>> file. Is that correct, and if so, in what situations? Only if the SP does not
>> specify a context, or does this override/take precedence for that SP?
>>> 
>>> 
>>> It's only used if the SP does not send a value.
>> 
>> Thanks for that. That's something, although personally, I think it should have
>> overridden any value the SP sent, although I understand the debate around
>> that. (I would have at least have it override if the requested context was any
>> form of the password-only based contexts.)
>> 


--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.