ExternalAuth - returning a different AuthenticationContextClassRef than requested

[Marvin Addison]

>
> A is requested. B is reached. Return A
>
> It is the last case I would like to change. If the auth process reached B,
> I want to return B even if A was requested.
>

We had a similar use case where we wanted this behavior in response to
inexact (better, minimum) matching on the SP. We met our requirements by
careful configuration of authn-comparison.xml and plugging in a custom
ValidateExternalAuthentication action, which was fairly straightforward.
That's to say you may need to write some extension components to do what
you want. Scott made some changes to that component, though, that might
have allowed us to get by with defaults but we never looped back around. It
was hard enough getting it through testing once ;)

M
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150904/d89df153/attachment.html>