ExternalAuth - returning a different AuthenticationContextClassRef than requested

[Stefan Santesson]

I have asked about this before, but I have to return to this.

This is currently the only missing piece in our Shib V3 deployment.


We have 2 closely related ContextClassRef, call them A and B. They both
represent a set of requirements on the auth process, as they should.

A = standard LoA 3 auth
B = A + some extra requirements

The externalAuth servlet is the one handling all the extra requirements. It
always attempts to meet the B requirements.

The current functionality is:
A is requested. A is reached. Return A
B is requested. Only A is reached. Return error
B is requested. B is reached. Return B
A is requested. B is reached. Return A

It is the last case I would like to change. If the auth process reached B, I
want to return B even if A was requested.

When we used Shib V2 IdP, we did this, and it was very simple. It was just
setting the reached contextClassRef as request attribute.
Is it possible to do with Shib V3?

/Stefan


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150904/235819d0/attachment.html>