Checking AuthnRequest for the presence of attributes

[SAMUELE RILLI]

>
> > or, for some custom AuthnContextClassRef, I need to check that
> ForceAuthn is set to 1.
> That would also be incorrect. AuthnContexts are orthogonal to ForceAuthn.
> These are not appropriate SAML requirements.
>
> Exactly, that's why I think I need custom checks. These restrictions are
demanded by my federation, not by SAML specs. It's like my federation
allows only a subset of possible SAML use scenarios.

2016-11-04 19:22 GMT+01:00 Cantor, Scott <cantor.2 at osu.edu>:

> > For example, our regulation says that the element Issuer must include the
> > attributes Format and NameQualifier;
>
> That would be wrong. The Issuer element should never contain NameQualifier
> for the SSO profile, and while it could contain Format, the value would
> have to be a particular value and so is generally never set. Requiring that
> both be set would be incorrect. Not just a bad idea, literally incorrect.
>
> > or, for some custom AuthnContextClassRef, I need to check that
> ForceAuthn is set to 1.
>
> That would also be incorrect. AuthnContexts are orthogonal to ForceAuthn.
>
> These are not appropriate SAML requirements.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161107/612c01fe/attachment.html>