AuthnContextClassRef - Password vs PasswordProtectedTransport

[Nate Klingenstein]

Donald,

The answer's a little nuanced.  The request is generated (typically) by the SP, which can specify the mechanism by which it would like users to be authenticated using the class reference as an identifier.  The IdP is responsible for meeting that level of authentication in its interpretation and responding with an assertion with the same level of authentication.

Without checking, IIRC, the IdP out of the box considers password over TLS, which is PasswordProtectedTransport, to also meet the requirements of Password, which is basically the bare minimum.

There's also the ability for an SP to request "better than", "at least", and other things, but those are rarely used.

You only really have to start understanding this when you start dealing with MFA or really wonky vendors.

Hope this helps,
Nate

--------
Signet, Inc.
The Art of Access ®

https://www.signet.id

-----Original message-----
From: Donald Lohr via users
Sent: Thursday, July 28 2022, 7:58 am
To: Shib Users
Cc: Donald Lohr
Subject: AuthnContextClassRef - Password vs PasswordProtectedTransport

Using the SAML tracer
      plugin for Firefox, on the SAML/POST entry after successfully
      providing my credentials (SSO login to an SP) I see:

    <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef>
      </saml2:AuthnContext>

        For some SP logins I see:

    <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef>
        </saml2:AuthnContext>

      All I've been able to find thus far as an explanation is the
      following:

      The Password class is applicable when a principal
      authenticates to an authentication authority through the
      presentation of a password over an unprotected HTTP session.

      The PasswordProtectedTransport class is applicable when a
      principal authenticates to an authentication authority through the
      presentation of a password over a protected session.

      Is Password or PasswordProtectedTransport controlled by how
        the SP is configured on the IdP side?

        Thanks,

        Don

-- 
D o n a l d   L o h r
I n f o r m a t i o n   S y s t e m s
J a m e s   M a d i s o n   U n i v e r s i t y
5 4 0 . 5 6 8 . 3 7 3 0

--

For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw

To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net