IdP v3 - IdP Initiated URLs?

[Tom Scavo]

On Fri, Mar 13, 2015 at 9:33 AM, Marc Boorshtein <mboorshtein at gmail.com> wrote:
> It mostly works (though it may be a config issue on my end).  When I do an
> SP initiated SSO, there's an authncontextclassref in the authnrequest of
> urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport and the
> same authncontextclassref is in the assertion in the response.  The same IdP
> however with IdP initiated gives me the authncontextclassref of
> urn:oasis:names:tc:SAML:2.0:ac:classes:Password.  Why are they different?

I'm not sure why you expect them to be the same. If you don't ask for
one, you get what you get.

Btw, I gave someone else this same advice earlier this morning: You're
better of not including a RequestedAuthnContext at all unless you have
some special (prearranged) requirement (like MFA).

Tom