minimizing system directory changes

[cneberg]

>>We use AuthenticationContext in SAML to handle that, and the IdP already
enforces that.
>>... you can default in RequestedAuthnContext behavior in most cases via a
relying-party setting that imposes a predefined rule to apply to the
request if the SP doesn't ask for anything
The main thing my class is doing so far is enforcing a particular minimum
authentication level based on the IP address of the client.  External
clients have higher authentication requirements than internal ones to the
same SP.   But in the future I might do external DB lookups based on
various attributes of the User and SP to make a determination as well.   So
I guess my question is do you support a dynamic determination of
authentication level for the REquestedAuthnContext level based on user
defined class. Looking at the docs, it looks like an activation condition
which selects a relying party config which enforces the correct auth
requirements might be a start.

On Mon, Jan 25, 2016 at 11:57 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > We use AuthenticationContext in SAML to handle that, and the IdP already
> > enforces that.
>
> (To clarify, while that normally does involve the SP, you can default in
> RequestedAuthnContext behavior in most cases via a relying-party setting
> that imposes a predefined rule to apply to the request if the SP doesn't
> ask for anything.)
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160127/dfaf6b24/attachment.html>