ShibIdP v4 & Azure SAML Authentication Issue with RequestedAuthnContext

[Cantor, Scott]

> When the IdP receives a SAML request from the Service Provider (SP) with
> RequestedAuthnContext and Comparison="exact," it passes that request to
> Azure.

You are obligated to honor the request from the SP, but you're not required to do anything specific in terms of relaying the exact values requested to a proxied IdP, so the defaultAuthenticationMethods setting (or a dynamic strategy) will override the pass through.

What you can't do is ignore the request, and the Principals added to the Subject after proxied authentication will be checked against the values requested by the SP.

> However, some browsers like Edge store the previous session and use X509
> certificates with Azure IDP

That is... hard to imagine. SPNEGO seems much more likely to be in play there. Also, using a certificate is what you'd do if you weren't honoring a session. A session would have to be cookie-based, I'd think.

Also, I wasn't aware that Azure even honors AuthnContext requirements. Given that it doesn't follow the standard in terms of populating them on the response, I don't know why they'd bother caring about the request, and if they did, they'd need to provide the means to control what the values mean to the IdP when it decides how to operate (as Shibboleth does). That's a better fix I would think.

-- Scott