AuthnContextClassRef from SSP SP seeming to be ignored

[Cantor, Scott]

On 1/11/17, 2:40 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

> I've got a SimpleSAMLphp SP that will be part of a proxy IdP setup. I'd like it to request our MFA context. It works fine with
> password authentication, but when I add: 'saml:AuthnContextClassRef' => 'urn:mace:incommon:uiuc.edu:custom'
>  (No, that's not really the context class ref I'm using; figured the realone didn't need to be posted here)
>    to the SP configuration, I still get through with just password. Requesting the same context from a Shib SP results in me
> being prompted for MFA.

My natural assumption would be that the testing methodology is flawed somehow, it would be far easier to assume that the real problem is with the IdP config than jumping to the idea that SSP is requesting it differently, just seems hard to believe.
    
>    The SP is definitely including the context class ref in the request. Here's the tail end of the request from the SSP logs:

That seems to show it only requesting a single context. The only likely explanation I could see would be if it was requesting multiple and one of them hit the password factor. So if not, I don't see how this is possible.

> What would be a good starting point for debugging this? What might I turn up logging for first? Or does anyone know of
> anything about the way that SSP passes such requests through that would cause it not to work with Shib?

I guess comparing a DEBUG log between the two SP cases maybe. Brent has a way of logging/printing the context tree inside the IdP but I haven't used it so I don't know how easy it is to get that into a script step or something like that, I think we talked about wiring that in as a feature people could more readily use but we haven't done that.

The machinery in the IdP is all going to respond to the RequestedPrincipalContext child, that's where the request's rules are going to be reflected. There's no reason that context would be different in these cases. If it were not, then it would be 100% clear the issue here is how you're testing and in what order, and that the other SP would be equally impacted.

-- Scott