can an application behind the SP get at the AuthnClass?

[Nate Klingenstein]

Jerry,

It's exported as an environment variable/header variable just like any other attribute.  The SP does it automatically.  Try looking at Shib-Authentication-Method or whatever permutation of that is set by the web server in the end.

Shib-Authentication-Method = urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport

From /Shibboleth.sso/Session:

Authentication Context Class: urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport

Take care,
Nate.

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id

-----Original message-----
From: Jerry Shipman
Sent: Thursday, April 22 2021, 11:11 am
To: users at shibboleth.net
Subject: can an application behind the SP get at the AuthnClass?

Hello,

I have an application behind a Shib SP on apache (trying to migrate it from a different web SSO system). Is there a way for me to find out which AuthnContextClassRef the user used to log in? The application
 currently gets this out of our old system basically in order to log whether it was a 1F or 2F session, which later feeds into some risk assessment decision. I can see how to map "attributes" to environment variables, but I haven't yet figured out how to get
 at the AuthnContextClassRef.  Can somebody point me in the right direction?

Thank you,

Jerry

--

For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net