different AuthnContextClassRef for different discovered IDP

[marangiom]

Cantor, Scott E. wrote
>> I decided simply to extend my idp, writing my own LoginHandler to handle
>> the 2 onknown types of authContextClassReference...
>> It would be just like the standard usernamePassword login handler, but it
>> handles the new authContextClassReference type.
> 
> You don't need to do that, the IdP already supports that.
> 
> -- Scott
> 
> -- 
> To unsubscribe from this list send an email to 

> users-unsubscribe@


how...?

I tried to configure my idp's handler.xml like this:

<ph:LoginHandler xsi:type="ph:UsernamePassword" 
                 
jaasConfigurationLocation="file://c:\opt\shibboleth-idp-242/conf/login.config">
<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</ph:AuthenticationMethod>
</ph:LoginHandler>

<ph:LoginHandler xsi:type="ph:UsernamePassword"
jaasConfigurationLocation="file://c:\opt\shibboleth-idp-242/conf/login.config">
<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:SpidL1</ph:AuthenticationMethod>
</ph:LoginHandler>

<ph:LoginHandler xsi:type="ph:UsernamePassword"
jaasConfigurationLocation="file://c:\opt\shibboleth-idp-242/conf/login.config">
<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:SpidL2</ph:AuthenticationMethod>
</ph:LoginHandler>
    
Now my idp fires up the standard username/password handler, but it can only
handle the PasswordProtectedTransport method.

so after the successful authentication, the IDP complains:

"Relying patry required an authentication method of
[urn:oasis:names:tc:SAML:2.0:ac:classes:SpidL1] but the login handler
performed urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"

I made a custom UsernamePasswordLoginServlet, but from what I can see it can
only override the authMetod via init parameter, i.e. not in a dynamic way.

what am I missing?
Thanks
M



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/different-AuthnContextClassRef-for-different-discovered-IDP-tp7625998p7626103.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.