AttributeFilterPolicy AuthenticationMethodRegex

[ERLER Peter]

Hi,

I use idp_version 3.3.1

I tried to use AttributeFilterPolicy with <PolicyRequirementRule PolicyRequirementRule xsi:type="AuthenticationMethodRegex" ...> as described in https://wiki.shibboleth.net/confluence/display/IDP30/AuthenticationMethodConfiguration. It didn't work as I expected so I had a look into the code.

AuthenticationMethodRegexpPolicyRule (and AuthenticationMethodPolicyRule respectively) matches against AttributeFilterContext#principalAuthenticationMethod which is set in FilterAttributes:356 with the value of AuthenticationResult#authenticationFlowId (in my case "authn/External").

Shouldn't it be something like "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" (e.g. from AuthenticationResult.getSupportedPrincipals(AuthnContextClassRefPrincipal.class)...) ?

Best regards!
Peter Erler

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170420/076eccca/attachment.html>