IdP v3 - IdP Initiated URLs?

[Cantor, Scott]

On 3/13/15, 10:04 AM, "Tom Scavo" <trscavo at gmail.com> wrote:

>On Fri, Mar 13, 2015 at 9:33 AM, Marc Boorshtein <mboorshtein at gmail.com> wrote:
>> It mostly works (though it may be a config issue on my end).  When I do an
>> SP initiated SSO, there's an authncontextclassref in the authnrequest of
>> urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport and the
>> same authncontextclassref is in the assertion in the response.  The same IdP
>> however with IdP initiated gives me the authncontextclassref of
>> urn:oasis:names:tc:SAML:2.0:ac:classes:Password.  Why are they different?
>
>I'm not sure why you expect them to be the same. If you don't ask for
>one, you get what you get.

They're different in 3.0 due to a quirk that I added a workaround for in 3.1 to favor PPT over P when both are "valid" for the response. The same login flows support both contexts, so it has to pick one and Ian noted the issue. We have a weighting hook now to favor one over another when they're otherwise equivalently valid to send back.

V2 was more limited and only really supported one context at a time coming back from a method, so it didn't have to worry about picking one.

-- Scott