authentication flow howto/tutorial

[Daniel McDonald]

On 07/13/2017 12:36 PM, Cantor, Scott wrote:
>> However when you try the mobile client, you never see our shibboleth
>> login page. Their server sends a few requests to our shibboleth server,
>> but then our shibboleth server seems to drop it.
> The log contains the explanation for that.
>
>> 2017-07-06 12:51:39,421 - DEBUG
>> [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:370] - Profile
>> Action SelectAuthenticationFlow: Specific principals requested with
>> 'maximum' operator:
>> [AuthnContextClassRefPrincipal{authnContextClassRef=urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient}]
> That's, umm, well it's nuts. I can't imagine what they're thinking, but some contractor they hired threw in something silly, basically.
>
> You could convince your system to handle that if you can't get them to fix it. It's not even exactly "wrong" if you did. The request is specifically for "a method that is at most as strong as TLS client certificate authentication".
>
> There is no rule to tell you what that means, that's a community profile sort of thing where you'd have to have consensus within a deployment community what is stronger or weaker. But most people would view passwords or a lot of common MFA methods as "as strong as or weaker than" TLS client authn.
>
> So if you teach the system that your login flow (password?) is something that satisfies that request, it will work. But I really wouldn't, I'd tell them to stop it, or explain what they're thinking.
>
> -- Scott
>

Thank you Scott! Its working, very happy :)

This isnt the first "why did they do that?" ive come across on this 
project. Considering they're closely partnered with EMC i'd Anyway, I 
made this edit in general-authn.xml. If there's another way I should be 
doing this please let me know.

    <bean id="authn/Password" parent="shibboleth.AuthenticationFlow"
                 p:passiveAuthenticationSupported="true"
                 p:forcedAuthenticationSupported="true">
             <property name="supportedPrincipals">
                 <list>
                     <bean parent="shibboleth.SAML2AuthnContextClassRef"
c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient" />
                 </list>
             </property>
         </bean>

Thanks
Dan