AuthnContextRef vs. AuthnContextDeclRef?

[Cantor, Scott]

> I've read the relevant sections of the SAML Core spec and the SAML
> Authentication Context spec but I can't seem to draw the distinction
> between the use of AuthnContextRef and AuthnContextDeclRef in either a
> AuthnReqest or as returned in an assertion.

Are you asking about ClassRef vs. DeclRef? I'm not parsing what you're asking otherwise.

> The only thing I could intuit was AuthnContextRef is meant to be used
> with the predefined classes in the Authentication Context spec and the
> AuthnContextDeclRef is for privately defined classes (because they have
> to be declared someplace, e.g. by following the URL ref or "inline" via
> AuthnContextDecl).

No, not at all. A ClassRef is the URI of a schema that defines a "class" of declarations that share some common set of restrictions and assumptions. In modern practice nobody bothers to define the schema and it's just implicitly a context that contains only a GoverningAgreement  referring to the definition of the class in plain language, and nobody pays any attention to any of that, they're just constants, like NameID Formats.

A DeclRef is a pointer to a full, no holds barred, all the gory details specific AuthnContext document. Nobody uses those and nobody should use DeclRef, unless they really want to point to a per-transaction document that isn't general at all and pertains to that specific assertion. Nobody does this and so nobody should be using the element.

> If an IdP receives an AuthnContextDeclRef or AuthnContextDecl in a
> AuthnRequest is it required to parse the declaration and confirm it
> satisfies the conditions before returning it in the assertion?

Yes.
 
> I've got an SP that sends two AuthnContextRef's in the AuthnRequest

You're really mixing names all over here. I really don't think I know what you're asking about.

-- Scott