Multiple authentication levels for a single application

[Guillaume Rousse]

Le 27/08/2019 à 17:04, Cantor, Scott a écrit :
>> In this scenario, with multiple potential results for a given flow, is
>> there any need for the SP to express a requirement in its authentication
>> request (as one or multiple authnContextClassRef values), or is it
>> useless, as the IdP only know about a single flow anyway ?
> 
> If you're talking about a Shibboleth IdP, flows are an internal issue. SPs don't request flows, they request context classes that are mapped into custom principal objects that are associated with flows (and often objects inside the flows) in an NxN relationship that is also entirely internal to the IdP.
I understood the difference between the end result, and the way to 
produce it. The SP asks for a given authentication method, and the IdP 
search in its available flows which ones are susceptibles to produce the 
expected result.

And I think I found the answer to my question in the IdP documentation:

But you need to bear in mind that at the end of the process, the result 
you produce had still better satisfy the request or the IdP will reject 
it. For example, if a service requests strong authentication in some 
way, and you short-circuit that by returning the result of password 
authentication, that is likely to be rejected by the IdP and fail the 
request.

As a consequence, if a SP expect its authentication query to be 
satisfied by an IdP using a conditional decision flow, it has to lower 
its minimal requirements to match the lowest one. For instance, 
something as:
<RequestedAuthnContext Comparison="better">
     <AuthnContextClassRef>
        urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
     </AuthnContextClassRef>
</RequestedAuthnContext>

Am I correct here ?

Regards.
-- 
Guillaume Rousse
Pôle SSI

Tel: +33 1 53 94 20 45
www.renater.fr

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3637 bytes
Desc: Signature cryptographique S/MIME
URL: <http://shibboleth.net/pipermail/users/attachments/20190827/f5d7e601/attachment.p7s>