Set / Override AuthnContextClassRef at the IDP

[Cantor, Scott]

On 1/9/18, 8:24 PM, "users on behalf of Reid Watson" <users-bounces at shibboleth.net on behalf of reid.watson at auckland.ac.nz> wrote:

 > Lets say Sp (SiteA)  RequestedAuthnContext has been set to "urn:oasis:names:tc:SAML:2.0:ac:classes:password”  the
> IDP will check the authenication message / TFA table (Query DB TFA table for site URL or entityID) and if a match exists
> the site is set or triggers TFA authentication instead of UserName / Password. The IDP will trigger TFA
> AuthenticationFlow instead of Password AuthenticationFlow… 

An SP should not be asking an IdP to use passwords. That doesn't really make any sense. Passwords are generally the baseline, not something to ask for.

When the MFA logic is a superset of Password anyway it isn't exactly wrong, just silly. When it's not a superset, it's inappropriate to do this. When an SP asks for X, you MUST do X. You're trying to get away with doing more than X, but in such a case, it should simply stop asking for X and leave the IdP to do what it wants.

-- Scott