ExternalAuth - returning a different AuthenticationContextClassRef than requested

[Cantor, Scott]

On 9/4/15, 10:58 AM, "users on behalf of Stefan Santesson" <users-bounces at shibboleth.net on behalf of stefan at aaa-sec.com> wrote:

>The current functionality is:
>A is requested. A is reached. Return A
>B is requested. Only A is reached. Return error
>B is requested. B is reached. Return B
>A is requested. B is reached. Return A

Do you mean that the SP is requesting A with an exact match operator? If not, I'll have to get more information.


>It is the last case I would like to change. If the auth process reached B, I want to return B even if A was requested.

That (meaning what I'm assuming you mean) is not allowed in SAML, and the IdP takes some pains to make sure if you do that, an error will be signaled so that you don't have to do the work of preventing an invalid response from happening.

>When we used Shib V2 IdP, we did this, and it was very simple. It was just setting the reached contextClassRef as request attribute.

I didn't think V2 was quite that broken as to let you signal a value that was incompatible with the request, but it certainly could be.

>Is it possible to do with Shib V3?

If it is, I still have a bug. But I'm pretty sure that's all tightened up. It lets you do things pretty dynamically up until it actually has to conclude the result is acceptable, and then it should be flagging it.

-- Scott