Shib IdP 3.3 MFA - AuthnContextClassRef issue

[Stefan Wold]

>
> Maybe you posted the wrong log, but the one you posted shows an SP
> requesting the PPT context, so unsurprisingly that's what gets returned.
>
> In the general case that both factors are performed and the SP requests
> nothing, it's nominally undefined what it will return because any of them
> are "valid", but you can control it for most purposes by adjusting entries
> in the PrincipalWeightMap bean to give them relative importance to each
> other.
>
> -- Scott
>
>
How embarrassing, it was actually my SP that was misconfigured (not a
Shibboleth SP). I just didn't connect the log message from the IdP and that
the SP was still requesting the PasswordProtectedTransport. After trying it
with a Shib SP it worked immediately.

Thanks for the tip about the PrincipalWeightMap, I'll give that a try for
SPs that doesn't request a specific AuthnContext.

Thank you for the help! :)

Cheers
Stefan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170328/8cc9faf9/attachment.html>