AuthnContextRef vs. AuthnContextDeclRef?

[John Dennis]

On 12/08/2016 11:25 AM, Cantor, Scott wrote:
>> I've read the relevant sections of the SAML Core spec and the SAML
>> Authentication Context spec but I can't seem to draw the distinction
>> between the use of AuthnContextRef and AuthnContextDeclRef in either a
>> AuthnReqest or as returned in an assertion.
>
> Are you asking about ClassRef vs. DeclRef? I'm not parsing what you're asking otherwise.

Yes, sorry for mangling the names :-(

>> The only thing I could intuit was AuthnContextRef is meant to be used
>> with the predefined classes in the Authentication Context spec and the
>> AuthnContextDeclRef is for privately defined classes (because they have
>> to be declared someplace, e.g. by following the URL ref or "inline" via
>> AuthnContextDecl).
>
> No, not at all. A ClassRef is the URI of a schema that defines a "class" of declarations that share some common set of restrictions and assumptions. In modern practice nobody bothers to define the schema and it's just implicitly a context that contains only a GoverningAgreement  referring to the definition of the class in plain language, and nobody pays any attention to any of that, they're just constants, like NameID Formats.
>
> A DeclRef is a pointer to a full, no holds barred, all the gory details specific AuthnContext document. Nobody uses those and nobody should use DeclRef, unless they really want to point to a per-transaction document that isn't general at all and pertains to that specific assertion. Nobody does this and so nobody should be using the element.
>
>> If an IdP receives an AuthnContextDeclRef or AuthnContextDecl in a
>> AuthnRequest is it required to parse the declaration and confirm it
>> satisfies the conditions before returning it in the assertion?
>
> Yes.
>
>> I've got an SP that sends two AuthnContextRef's in the AuthnRequest
>
> You're really mixing names all over here. I really don't think I know what you're asking about.

Apologies for the getting the names wrong, yes I'm talking about a 
ClassRef vs. a DeclRef and I'm trying to understand the difference.

Specifically this is what is in the AuthnRequest

> <samlp:RequestedAuthnContext>
>     <saml:AuthnContextClassRef>secure/name/password/icmaolr/uri</saml:AuthnContextClassRef>
> </samlp:RequestedAuthnContext>

I have no idea what "secure/name/password/icmaolr/uri" is or where it 
came from. Also, the fact it is not a URI seems wrong.

The assertion comes back from the IdP with this:

> <saml:AuthnContext>
>     <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
>     <saml:AuthnContextDeclRef>secure/name/password/icmaolr/uri</saml:AuthnContextDeclRef>
> </saml:AuthnContext>

The original requested ClassRef comes back as a DeclRef in the 
assertion. So I'm trying to figure out why, if that is correct, and 
overall why and when a DeclRef should be used (thanks for the 
explanation above)

So is returning the requested ClassRef as a DeclRef a protocol 
violation? A bug in the IdP? Is the IdP trying to say "I didn't 
understand the requested ClassRef"? If so shouldn't it have failed the 
AuthnRequest?

The SP rejects the assertion because it does not find the requested 
ClassRef in the assertion (which I believe is correct behavior).

Hopefully I've been more clear this time around.


-- 
John