minimizing system directory changes

[Cantor, Scott]

On 1/27/16, 10:58 AM, "users on behalf of cneberg" <users-bounces at shibboleth.net on behalf of cneberg at gmail.com> wrote:



>The main thing my class is doing so far is enforcing a particular minimum authentication level based on the IP address of the client.  External clients have higher authentication requirements than internal ones to the same SP.

I see.

>But in the future I might do external DB lookups based on various attributes of the User and SP to make a determination as well.   So I guess my question is do you support a dynamic determination of authentication level for the REquestedAuthnContext level based on user defined class.
> Looking at the docs, it looks like an activation condition which selects a relying party config which enforces the correct auth requirements might be a start.

Only if it needs access solely to information available at the beginning. That wouldn't include user identity, attributes, etc. It would include client address.

Same would be true for activation conditions attached to a login flow since by definition the user identity just isn't known yet.

The mild exception to that is if you force initial-authn via password, unconditionally, and then put conditions on the "main" login flows that depend on information acquired after the password step.

So, yeah, might work, but it's situational.

-- Scott