unspecified AuthnContextClassRef

[Roehrl Patrick]

Hello,

I'm upgrading from IdP 2 to IdP 3.2.1.
At IdP 2 we used the AuthenticationMethods "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" and "urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified" in the SAML Authn Requests to select an LoginHandler.

Now at IdP3 I wanted to use the AuthenticationMethods to select an authentication flow.
While doing some research I found this ticket https://issues.shibboleth.net/jira/browse/IDP-780 .
So I added the following lines in general-authn.xml to the AvailableAuthenticationFlows:

        <bean id="authn/Password" parent="shibboleth.AuthenticationFlow"
                p:passiveAuthenticationSupported="true"
                p:forcedAuthenticationSupported="true">
                  <property name="supportedPrincipals">
                        <util:list>
                              <bean parent="shibboleth.SAML2AuthnContextClassRef"
                                                                     c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
                        </util:list>
                  </property>
            </bean>

            <bean id="authn/IdpLoginToken" parent="shibboleth.AuthenticationFlow"
                        p:passiveAuthenticationSupported="true"
                        p:forcedAuthenticationSupported="true"
                        p:nonBrowserSupported="false">
                  <property name="supportedPrincipals">
                        <util:list>
                              <bean parent="shibboleth.SAML2AuthnContextClassRef"
                                          c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified"/>
                        </util:list>
                  </property>
            </bean>

No when I'm sending an AuthnRequest with PasswordProtectedTransport AuthenticationMethod, the IdP shows me the auth/Password flow with the Username/Password form --> okay.
But when I'm sending an AuthRequest with unspecified AuthenticationMethod, the IdP also shows me the Username/Password form instead it calls the IdpLoginToken flow.
In the idp-process log it says: "Profile Action ProcessRequestedAuthnContext: Ignoring AuthnContextClassRef: urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified"

So what am I doing wrong? Why does the IdP ignore my unspecified AuthContextClassRef?

Hope the description of my problem was clear enough ;)

Thanks for any kind of help!

Greets Patrick
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160804/aff5d649/attachment-0001.html>