Set / Override AuthnContextClassRef at the IDP

[Reid Watson]

Hi Everyone, 

We have a project coming up in the next few weeks and I would like some advice and thoughts around the solution. 

Project: IDP 3.3.1 to overwrite SP authnContextClassRef “Password” to Two-Factor Authentication (TFA)

As you know at the Native SP Apache Config you can set AuthnRequest messages, this will override the authnContextClassRef attribute of a SessionInitiator… 

	ShibRequestSetting authnContextClassRef urn:oasis:names:tc:SAML:2.0:ac:classes:password 

What we went to achieve is to overwrite / set TFA authentication based on the URL or entityID of the site at the IDP.. 

Basic Example 

Lets say Sp (SiteA)  RequestedAuthnContext has been set to "urn:oasis:names:tc:SAML:2.0:ac:classes:password”  the IDP will check the authenication message / TFA table (Query DB TFA table for site URL or entityID) and if a match exists the site is set or triggers TFA authentication instead of UserName / Password. The IDP will trigger TFA AuthenticationFlow instead of Password AuthenticationFlow… 

I did read the post  “Override SP RequestedAuthnContext on IdP per entity?” and one comment that was made “Not elegantly” what worries me but were still investigating ideas and I was just looking for some thoughts or advice..

Cheers

Reid