RequestedAuthnContext with a Comparison="maximum"

[Cantor, Scott]

On 9/21/16, 8:26 AM, "users on behalf of Youssef  GHORBAL" <users-bounces at shibboleth.net on behalf of youssef.ghorbal at pasteur.fr> wrote:

> 	I have a mobile app that initiates Authn requests with an RequestedAuthnContext set
> like this :

Deliberately? If so, why? If this isn't deliberate, the proper thing to do is to fix the bug.

>	Since the app seems to express a “maximum” requirement, I think that it would be
> suffisient for it to have ProtectedPassword context (is that what is meant for “maximum”?

It is impossible for the IdP to honor anything but exact unless you teach it how to do that for the values you have to support. This isn't an AI. It doesn't know what any of the strings mean.

>	To deal with the situation, and since I’m not intending to add support for x509 auth
>anytime soon, I was thinking going lazy and simply ignore the AuthnContextClassRef of value
> "urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient” using the 3.2 feature
> (shibboleth.IgnoredContexts in authn/authn-comparison.xml) 

That is not the proper way to fix it. You need to teach it the relationship between the values you do support and the value(s) being requested using the comparison beans provided for that purpose.

But that's all silly. The application is broken. Tell them to fix it.

-- Scott