Specify a default authentication context in Relying Party config

[Michael A Grady]

> On Nov 30, 2015, at 9:52 AM, Cantor, Scott <cantor.2 at OSU.EDU> wrote:
> 
> On 11/30/15, 10:07 AM, "users on behalf of Michael A Grady" <users-bounces at shibboleth.net on behalf of mgrady at unicon.net> wrote:
> 
> 
> 
>> How can I set a particular default authentication context in relying-party.xml? I was trying to use the property p:defaultAuthenticationContexts, modeling after the examples for setting p:nameIDFormatPrecedence, but that raises an error, because I hadn't noticed at first that the defaultAuthenticationContexts list values need to be of type 'AuthnContextClassRefPrincipal', not simple string values. The goal is to set a default of a context like 'http://www.duosecurity.com/', requiring 2FA for that SP.
> 
> Just supply a list of beans of that type. Same syntax as the equivalent collection property in general-authn.xml
> 
> -- Scott
> 

Can't seem to get that quite right, but then (rediscovered) that there is one example in:

  https://wiki.shibboleth.net/confluence/display/IDP30/AuthenticationFlowSelection

that references the property 'p:defaultAuthenticationMethods' (aligning with the v2 defaultAuthenticationMethod) that can be used with (at least) the SAML2 SSO profile. That property doesn't seem to be documented anywhere else at this time (it is mentioned in the v2 to v3 config changes, but not as the plural form). Is that a property that is intended to "stick around", and thus ok to use?

So I can get the behavior I want with:

      <bean id="SAML2.SSO.requireDuo" parent="SAML2.SSO" p:defaultAuthenticationMethods="http://www.duosecurity.com/" />


--
Michael A. Grady
IAM Architect, Unicon, Inc.