ExternalAuth - returning a different AuthenticationContextClassRef than requested

[Cantor, Scott]

On 9/4/15, 11:05 PM, "Stefan Santesson" <stefan at aaa-sec.com> wrote:

>The case I described would require inexact matching (minimum).
>
>My primary task here is to write the SAML profile for our federation. My
>IdP is just a reference implementation. So I want to keep this as simple
>as possible.
>I¹m thinking of another way that actually would solve my problem,

I'm not aware of anybody supporting inexact matching but Shibboleth so seems like you may need to take that into account.

>What if an SP that could accept A but prefer B if possible would list both
>A and B as RequestedAuthnContext, combined with an IdP configuration that
>favour B over A but accepts both?
>I assume this could be done with exact match.

Yes, as long as you're willing to enumerate, that's certainly possible.

>An IdP that can handle B would then return B and an IdP that only can
>handle A would return A.
>
>Can Shib V3 IdP handle multiple requested contextClassRefs this way?

Yes.

-- Scott