Ex: mfaCtx.isAcceptable() and entity tags

[Paul B. Henson]

On Wed, Sep 09, 2020 at 10:35:28PM -0700, Paul B. Henson wrote:

> 2020-09-09 22:28:10,365 - 10.104.223.197/node0wef3upsvjduo1xfyv93zgc7zj0 - DEBUG [net.shibboleth.idp.saml.profile.config.AbstractMetadataDrivenConfigurationLookupStrategy:322] - No applicable mapped tag, applying default strategy for 'defaultAuthenticationMethods'

After digging through the source, I tried setting
idp.service.relyingparty.ignoreUnmappedEntityAttributes to false in
/opt/shibboleth-idp/conf/services.properties, and it works:

.AbstractMetadataDrivenConfigurationLookupStrategy:345] - Found matching
tag 'http://shibboleth.net/ns/profiles/defaultA
uthenticationMethods' for property 'defaultAuthenticationMethods'
2020-09-09 22:47:50,832 - 10.104.223.197/node01xd9is83r6m7em6o7h6udrndq0
- DEBUG [net.shibboleth.idp.saml.profile.config
.ListConfigurationLookupStrategy:72] - Converting tag
'http://shibboleth.net/ns/profiles/defaultAuthenticationMethods' t
o List<AuthnContextClassRefPrincipal> property

This option is set to true by default in the distribution? I found a
mention of something similar:

https://wiki.shibboleth.net/confluence/display/DEV/2020-05-15

although it was talking about OIDC, not SAML? Is this a bug? Or am I
doing someting wrong such that it doesn't work with the out of the box
setting for ignoreUnmappedEntityAttributes?

Thanks...


-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768