MFA and authentication Context

[Mark Boyce]

I may have missed the "weight map"... So, that being the case, for an SP that requires Refeds and doesn't request same, I would need a Relying Party override and the rest I can simply use PPT, even though a second factor was invoked, without breaking the world.

Thanks,

m.

-----Original Message-----
From: "Cantor, Scott" <cantor.2 at osu.edu<mailto:%22Cantor,%20Scott%22%20%3ccantor.2 at osu.edu%3e>>
Reply-To: Shib Users <users at shibboleth.net<mailto:Shib%20Users%20%3cusers at shibboleth.net%3e>>
To: Shib Users <users at shibboleth.net<mailto:Shib%20Users%20%3cusers at shibboleth.net%3e>>
Subject: Re: MFA and authentication Context
Date: Wed, 14 Apr 2021 16:39:04 +0000


On 4/14/21, 12:28 PM, "users on behalf of Mark Boyce" <

<mailto:users-bounces at shibboleth.net>

users-bounces at shibboleth.net

 on behalf of

<mailto:Mark.Boyce at ucop.edu>

Mark.Boyce at ucop.edu

> wrote:


If the SP requests a specific context, I am able to return that properly, but in cases where the SP is not

requesting, I would like to send back what context was used as appropriate.


There isn't any concept of appropriate in that case, they all are correct. The determination of what ends up in the assertion when there are no requirements is based on the weight map. All AuthnContextClassRefPrincipals in the Subject are sorted against the weight map and the highest weighted is what it uses.


I believe the documentation covers that but I'm not in front of it.


-- Scott


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210414/e5b5a1c1/attachment.htm>