Changing IDP4 SAML Authentication RequestedAuthnContext Comparison value
McLennan, Neil R
n.mclennan at imperial.ac.uk
Fri Nov 26 13:12:02 UTC 2021
Has anybody worked out how to alter the RequestedAuthnContext for SAML authentication so that <saml2p:RequestedAuthnContext Comparison="exact"> ?
As per the useful https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631678/RelyingPartyConfiguration I have updated the relying party for the SAML authentication hoping it might override <saml2p:RequestedAuthnContext Comparison="minimum"> however it remains the same
Authentication request into Shibboleth
<saml2p:RequestedAuthnContext Comparison="minimum">
<saml2:AuthnContextClassRef xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef>
</saml2p:RequestedAuthnContext>
Outgoing Authentication request from Shibboleth remains as
<saml2p:RequestedAuthnContext Comparison="minimum">
<saml2:AuthnContextClassRef xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef>
</saml2p:RequestedAuthnContext>
What am I missing in the Relying Party configuration for SAML authentication?
<bean parent="RelyingPartyByName" c:relyingPartyIds="https://sts.windows.net/xxxxxxxxxxxxxxx/">
<property name="profileConfigurations">
<list>
<bean parent="SAML2.SSO" p:disallowedFeatures-ref="SAML2.SSO.FEATURE_AUTHNCONTEXT">
<property name="defaultAuthenticationMethods">
<list>
<bean parent="shibboleth.SAML2AuthnContextClassRef"
c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" />
</list>
</property>
</bean>
</list>
</property>
</bean>
However
Authentication request into Shibboleth
<saml2p:RequestedAuthnContext Comparison="minimum">
<saml2:AuthnContextClassRef xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef>
</saml2p:RequestedAuthnContext>
Outgoing Authentication request from Shibboleth remains as
<saml2p:RequestedAuthnContext Comparison="minimum">
<saml2:AuthnContextClassRef xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef>
</saml2p:RequestedAuthnContext>
Regards
Neil McLennan
More information about the users
mailing list