Shib Authn Proxy to Azure and Asserting REFEDS

Jeffrey Williams jfwillia at
Fri Jan 22 22:03:15 UTC 2021

Hi All,

I'm trying to configure Shibboelth v4.0.1 to assert after a user MFA's via proxy to Azure and am
running into some interesting questions.

I have a semi-working instance of running in development that is doing
proxying to Azure using the instructions given at:

(note, some additional work to the Azure metadata and subject-c14n.xml were
needed, but not much)

The issue I'm currently dealing with is that Azure AD doesn't have it
clearly documented what AuthnContexts one can request from it aside from

What Azure seems to do instead is return the above AuthnContext and include
an attribute
which returns the various authn's the user performed.

The example code in authn-comparison.xml seems to indicate that it'll
happily convert between AuthnContexts using shibboleth.
Will it also allow AuthnContextClassRef to be influenced by a value
returned in the attribute statement?

For example, if  within the AttributeStatement, an attribute contained a
value, could one map that
to a authnContextClassRef in the
AuthnStatement? Or is the mapping more simple than that?

If that's not possible, would it be possible to run a script after the
authn/SAML flow that would do the attribute check and update the
AuthnContext accordingly?  I've done scripting for determining when to
present the Duo iFrame, but I'm not sure if it's possible to replace the
AuthnContextClassRef value from a script or not.

Jeffrey Williams
Identity & Access Engineer
Identity & Access Services
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the users mailing list