Fun with proxying to AzureAD

[Jeffrey Williams]

> Hi Jeff,
>
> From what I can see the snippet on the wiki page is mapping between
> AuthnContextClassRefs but our observation is that Azure emits that
> "multipleauthn" assertion as an Attribute in the AttributeStatement rather
> than in the AuthnContext:
>
> > <AttributeStatement>
> > ...
> >     <Attribute Name="
> http://schemas.microsoft.com/claims/authnmethodsreferences">
> >         <AttributeValue>
> http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password
> </AttributeValue>
> >         <AttributeValue>
> http://schemas.microsoft.com/claims/multipleauthn</AttributeValue>
> >     </Attribute>
> > ...
>
> > </AttributeStatement>
> > ...
> > <AuthnStatement AuthnInstant="..." SessionIndex="...">
> >     <AuthnContext>
> >
>  <AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef>
> >     </AuthnContext>
> > </AuthnStatement>
>
> Am I barking up the wrong tree or have you "done something" to the Azure
> IdP end to get it to emit this as an AuthnContextClassRef?
>

We didn't make any changes to Azure, but its AuthnContext behavior seems to
go with returning the minimum requested level of authn to the SP,
defaulting to password, at least where password is used in the MFA stack.

So if your SP doesn't request a particular level of authn and your user
does MFA, Azure still sends back a password AuthnContext.  If the SP
requests MFA (http://schemas.microsoft.com/claims/multipleauthn), and the
user successfully performs it, Azure will return
http://schemas.microsoft.com/claims/multipleauthn.  You can then map it to
the REFEDS equivalent to send back to the SP.

  authnmethodsreferences is one of the default attributes Azure sends to
SP's I believe so that ADFS operators can do MFA requirements in their ADFS
way. I don't believe it impacts Shibboleth's IdP behavior in any meaningful
way.



> Thanks,
> --
> Matthew Slowe (GPG: 0x6BE0CF7D04600314)
> Senior Technical Consultant and Support specialist - Trust & Identity, Jisc
> Team: 0300 300 2212, option 2
> Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG
>
>

-- 
Jeffrey Williams
Identity & Access Engineer
Identity & Access Services
https://its.uncg.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210608/f26a58a1/attachment.htm>