addDefaultPrincipals vs PrincipalProxyResponseMappings

[Tony Skalski]

I am updating our 4.0.1 IdP authn configuration to use a SAML proxy (for
all users). One of our SPs requests AuthnContextClassRef
urn:oasis:names:tc:SAML:2.0:ac:classes:Password. However, the proxied IdP's
AuthnStatement "specifies"
urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified. We have no control over
the proxied IdP but it does enforce MFA for all but a fraction of a percent
of our users. Logins to this SP yield:

2021-02-23 22:54:31,964 - WARN
[net.shibboleth.idp.authn.impl.FinalizeAuthentication:168] - Profile Action
FinalizeAuthentication: Authentication result for flow authn/SAML did not
satisfy the request

I can workaround this issue by setting the below in
conf/authn/saml-authn-config.xml:

<util:constant id="shibboleth.authn.SAML.addDefaultPrincipals"
static-field="java.lang.Boolean.TRUE"/>

Heeding the warning that precedes this option, I undid the above and
configured a mapping in conf/authn/authn-comparison.xml. This worked as
well:

    <util:map id="shibboleth.PrincipalProxyResponseMappings">
        <entry>
            <key>
                <bean parent="shibboleth.SAML2AuthnContextClassRef"

c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified" />
            </key>
            <list>
                <bean parent="shibboleth.SAML2AuthnContextClassRef"

c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" />
            </list>
        </entry>
    </util:map>

I presume the second option is the preferred method. Before I promote this
to production, is there anything wrong with this configuration, or anything
that should be done differently? Thanks!

ajs
-- 
*Tony Skalski*
System Administrator | IT

*Office: *507-786-3227 <(507)786-3227>
1510 St. Olaf Avenue Northfield, MN 55057
stolaf.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210224/a508be62/attachment.htm>