updating satisfied authnContext based on server environment variables?

[Cantor, Scott]

> We've received a request to update the authnContext to reflect when
> someone has authenticated using 2FA because of opt-in (instead of only
> showing it if the SP has requested a different context).

I would think that would normally be the case or you'd be operating incorrectly. Not so much due to omitting it when it could be asserted but the converse. If you have it set up to assume that the result coming back satisfies the MFA context class, it would be inaccurate and could allow for a password login in the case where the SP requests MFA.

I might not understand the situation, but that's what it sounds like.

> Would it be possible / is it reasonable to assert a different authnContext
> based on the factors satisfied by the external SSO?  The Cosign SP does
> reveal to the server environment what factors have been satisfied, and we
> could try to pass that into Tomcat.

I'm basically wondering how it could be operating correctly if you didn't already do that?

But be that as it may, assuming you're using RemoteUser, it's documented, authMethodHeader.

-- Scott