AuthenticationContext with MFA

[Cantor, Scott]

> 1. If an SP explicitly requests PasswordProtectedTransport, will the IDP
> still return PasswordProtectedTransport even if password+Duo is
> performed?
> The comments in general-authn.xml say so.

If the result contains that context and the SP asks for it, then it will express that context in the assertion to satisfy the standard's requirement that it return what was asked for. There are scenarios where that won't really be accurate which is why it's ultimately up to the MFA login flow's "result merging" step to ensure the final result contains what it should, and that isn't necessarily the union of the individual factors in every situation.

> I'm just curious if there are known bad SPs that are going to barf if they
> don't see a well-known AuthnContextClassRef, such as
> PasswordProtectedTransport, in the response.

Some, I imagine. We have all employees using Duo with our HR system. Random browsing of services would probably have broken something if it were common, but that doesn't mean anyting in the aggregate.

-- Scott