Shibboleth IDP v4.2 : Disable AuthContextClassRef Check in SAML Proxying

[Cantor, Scott]

As Peter said, the original SP should simply stop and then you're done. Alternatively, let them get away with it, do a ton of work, and create technical debt for yourself and whoever inherits it. One of those two options makes sense and the other really doesn't.

On 7/27/22, 11:57 PM, "users on behalf of Prasanna CG via users" <users-bounces at shibboleth.net on behalf of users at shibboleth.net> wrote:

> In this process, the SP first requests authcontext of “Password Protected“
> in the auth request. The same gets preserved up to Third Party IDP which
> completes the AuthN and returns a custom authcontextclassref.

Such an IdP is not SAML-compliant and has a bug, because it isn't permissible to return something that doesn't match the request, and trying to cover for *that* creates more complexity.

> This value is preserved up to the Downstream IDP that returns an error to
> the SP due to the difference in contextclassref between its  request and
> response from Upstream IDP.  

If the result from the other IdP only carried the custom value, then there would be no possible way for the Shibboleth software to actually return PasswordProtectedTransport to the original SP, and it would instead return an error. So something you're describing is off.

>    Question: Is there a configuration in Shibboleth IDP that allows me to
> disable this check and simply return the originally requested contextclassref
> (password protected) ? 

There are two hooks on the SAML2.SSO bean for injecting mapping functions.

https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631694/SAML2SSOConfiguration

Under profile-specific with a note about them under Guidance.

The default behavior supports a pair of maps in both directions for mapping specific contexts both ways, shibboleth.PrincipalProxyRequestMappings and shibboleth.PrincipalProxyResponseMappings:

https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631601/AuthenticationConfiguration

Under Proxying.

-- Scott