Using a different SP entity ID with the IdP SAML authn flow
kwessel at illinois.edu
Wed Sep 8 01:57:11 UTC 2021
I've finally had time to look over the Javadocs and process your suggestion, Scott, and it makes sense. The value returned from getName should correspond with the authnContextClassRef string -- in this case, the Refeds MFA profile. Correct?
Only remaining question is what's the best way to search the principal objects returned from getRequestedPrincipals? A for loop is the most obvious, calling getName on each item in the list. Is there a more efficient technique? Sorry to have to take this post to coding advice.
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Friday, September 3, 2021 7:05 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Using a different SP entity ID with the IdP SAML authn flow
On 9/2/21, 3:57 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:
> So, something like this?
The RequestedPrincipalContext is not a context class in the SAML sense, it's one in the IdP sense. It's a Java object containing the extracted details from the AuthnRequest in neutral form. The javadocs on it will demonstrate how to use it to examine the contents once you have a handle on it.
> Does that look sane? If it doesn't work, I'll certainly study the
> docs for some of the objects I'm using to get the requested authnContextClassRef since, as you stated, that's a rough guess.
You need the docs.
Basically assuming getOperator() is "exact", the getRequestedPrincipals() method will return the AuthnContextClassRefPrincipal objects that got build from the SP's request that you can search through for a match, which in turn will return the context class string via getName()
All the abstraction and extra layers is needed to get portability, it's not a SAML feature internally, just an abstracted equivalent based on it. So it works similarly for OIDC and CAS.
For Consortium Member technical support, see https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!DZ3fjg!q8-3DZjj0gKM4esg9z51MvuPzgLw0n9AS8PbHgj0VjF8BVrrZYv9krgbgDgW2lUuMQ$
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
More information about the users