Multiple authentication levels for a single application

[Cantor, Scott]

On 8/27/19, 11:42 AM, "users on behalf of Guillaume Rousse" <users-bounces at shibboleth.net on behalf of guillaume.rousse at renater.fr> wrote:

> As a consequence, if a SP expect its authentication query to be 
> satisfied by an IdP using a conditional decision flow, it has to lower 
> its minimal requirements to match the lowest one. For instance, 
> something as:
> <RequestedAuthnContext Comparison="better">

I don't know what you mean by conditional decision flow, but there's no single answer to any question about how all this works in any given case unless there's specific knowledge of what's been done. I can tell you how my system will respond to any given request and I can post my logic, but that's the extent of it.

Most IdPs do not support inexact matching, and even then you have to count on a ton of shared understanding to make it work right. There's no objective basis for inexact matching to work without OOB assumptions.

All anybody with an SP can do is presume the IdP won't lie, and even that isn't always a great assumption because people manipulate settings to get errors to stop without caring whether the result is correct or not.

-- Scott