ExternalAuth - returning a different AuthenticationContextClassRef than requested

[Stefan Santesson]

The case I described would require inexact matching (minimum).

My primary task here is to write the SAML profile for our federation. My
IdP is just a reference implementation. So I want to keep this as simple
as possible.
I¹m thinking of another way that actually would solve my problem,

What if an SP that could accept A but prefer B if possible would list both
A and B as RequestedAuthnContext, combined with an IdP configuration that
favour B over A but accepts both?
I assume this could be done with exact match.

An IdP that can handle B would then return B and an IdP that only can
handle A would return A.

Can Shib V3 IdP handle multiple requested contextClassRefs this way?

/Stefan


On 04/09/15 18:57, "users on behalf of Cantor, Scott"
<users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

>On 9/4/15, 12:44 PM, "users on behalf of Marvin Addison"
><users-bounces at shibboleth.net on behalf of marvin.addison at gmail.com>
>wrote:
>
>>We had a similar use case where we wanted this behavior in response to
>>inexact (better, minimum) matching on the SP. We met our requirements by
>>careful configuration of authn-comparison.xml and plugging in a custom
>>ValidateExternalAuthentication action, which was fairly straightforward.
>>That's to say you may need to write some extension components to do what
>>you want. Scott made some changes to that component, though, that might
>>have allowed us to get by with defaults but we never looped back around.
>
>I didn't remember when I fixed it, but I checked, it's not released yet,
>it's patched for 3.2.0. So yeah, that's another factor here for an
>External handler depending on the scenario.
>
>But that's inexact matching of course, allowing for the result to be
>different.
>
>-- Scott
>
>-- 
>To unsubscribe from this list send an email to
>users-unsubscribe at shibboleth.net