Using IgnoredContexts to work around a fussy SP

[Duncan Sinclair]

Hi Folks,

We've got a SP that is requesting an authentication context of "urn:...:Password", but we've got a few users that are using "passwordless" login in EntraID, which we use for authentication for Shibboleth. (IdP Version 4.3.1.)

I have tested this modification to conf/authn/authn-comparison.xml and it seems to work:

  <util:list id="shibboleth.IgnoredContexts">
    <value>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</value>
+   <value>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</value>
  </util:list>

What I'd like to know is, is there any risks by doing this?

And is there a way to do this just for the single SP that has this problem?

Many thanks,


Duncan Sinclair.


--
Duncan Sinclair
Infrastructure Specialist – Systems
IT Services – Abertay University, Dundee

[Abertay Named UK University of the Year for Teaching Quality]<https://abertay.co/ZTQw>

Abertay University is a charity registered in Scotland, No. SC016040

Follow us: www.abertay.ac.uk<http://www.abertay.ac.uk> | @AbertayUni<https://twitter.com/AbertayUni> | AbertayLinkedIn<https://www.linkedin.com/edu/school?id=12685> | AbertayFacebook<https://www.facebook.com/AbertayUni>

Any views or opinions expressed in this email and any attachments are solely those of the author and do not necessarily represent those of Abertay University. This email and any attachments may be confidential and are intended solely for the use of the intended recipient. If you are not the intended recipient, you must take no action based on the email or its attachments, nor must you copy or show them to anyone. Please contact the sender if you believe you have received this email in error.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240202/996dcc3e/attachment.htm>