IdP v3 - IdP Initiated URLs?

[Marc Boorshtein]

Ok so upgrading to 3.1 should eliminate this issue?
On Mar 13, 2015 10:08 AM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

> On 3/13/15, 10:04 AM, "Tom Scavo" <trscavo at gmail.com> wrote:
>
> >On Fri, Mar 13, 2015 at 9:33 AM, Marc Boorshtein <mboorshtein at gmail.com>
> wrote:
> >> It mostly works (though it may be a config issue on my end).  When I do
> an
> >> SP initiated SSO, there's an authncontextclassref in the authnrequest of
> >> urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport and
> the
> >> same authncontextclassref is in the assertion in the response.  The
> same IdP
> >> however with IdP initiated gives me the authncontextclassref of
> >> urn:oasis:names:tc:SAML:2.0:ac:classes:Password.  Why are they
> different?
> >
> >I'm not sure why you expect them to be the same. If you don't ask for
> >one, you get what you get.
>
> They're different in 3.0 due to a quirk that I added a workaround for in
> 3.1 to favor PPT over P when both are "valid" for the response. The same
> login flows support both contexts, so it has to pick one and Ian noted the
> issue. We have a weighting hook now to favor one over another when they're
> otherwise equivalently valid to send back.
>
> V2 was more limited and only really supported one context at a time coming
> back from a method, so it didn't have to worry about picking one.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20150313/7ecfc50f/attachment-0001.html