MFA and authentication Context

[Cantor, Scott]

On 4/14/21, 12:48 PM, "users on behalf of Mark Boyce" <users-bounces at shibboleth.net on behalf of Mark.Boyce at ucop.edu> wrote:

>    I may have missed the "weight map"... So, that being the case, for an SP that requires Refeds and doesn't
> request same, I would need a Relying Party override and the rest I can simply use PPT, even though a second
> factor was invoked, without breaking the world.

There are usually better ways to do anything these days than overrides, but conceptually, yes. If you impose a requirement on the IdP side in the right way, then you don't need any weighting, it will return whatever matches the requirement the same as if the SP asked for it.

Whether you want to express PPT in those cases is a different question but the weighting allows whatever you want.

-- Scott