RequestedAuthnContext with a Comparison="maximum"

[Youssef GHORBAL]

Hello,

	I have a mobile app that initiates Authn requests with an RequestedAuthnContext set like this :

<samlp:RequestedAuthnContext Comparison="maximum”>
	<saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion”> urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient </saml:AuthnContextClassRef>
</samlp:RequestedAuthnContext>

	The IdP documentation has an explanation on how comparasion configuration is done : 
	https://wiki.shibboleth.net/confluence/display/IDP30/AuthenticationFlowSelection

	I only have the “Password” flow activated right now (idp.authn.flows=Password) and did’nt change any defaults in the comparision configuration, so for now the IdP ignores the request and logs 

2016-09-21 14:19:47,902 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:?] - Profile Action SelectAuthenticationFlow: None of the potential authentication flows can satisfy the request

	Since the app seems to express a “maximum” requirement, I think that it would be suffisient for it to have ProtectedPassword context (is that what is meant for “maximum” ?)

	To deal with the situation, and since I’m not intending to add support for x509 auth anytime soon, I was thinking going lazy and simply ignore the AuthnContextClassRef of value "urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient” using the 3.2 feature (shibboleth.IgnoredContexts in authn/authn-comparison.xml) 

	I was just wondering if there are any non obvious side effects of doing so ?

Youssef Ghorbal