Issue with SPs requesting specific authentication methods when using SAML Proxy with EntraID

[Cantor, Scott]

> I only have control over the IdP so I concluded, that I
> somehow have to remove these requirements from the
> SAML request to EntraID, because it seemingly can't handle
> them correctly

That doesn't really buy you anything unless you intend to lie to the SPs at the end if/when the proxied IdP doesn't satisfy those requirements. Removing them makes it impossible for Entra to know what to do, even were it capable of doing so.

 > but haven't found instructions for that in the
> documentation.

I need to get pointers in place in the SAMLAuthn docs, but it's in the parent topic at the moment because proxying isn't exclusive to that one method.

https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505085/AuthenticationConfiguration#Advanced-Topics

Under Advanced Topics -> Authentication Type Mapping

There are maps by default to automate mapping in both directions, but  pass-through is the default.

As I say, that doesn't help a lot. Entra is not SAML compliant in this area and while it's fairly easy to transform the upstream direction, Entra doesn't use AuthnContext properly in its responses. So it's more complex and non-automated to do anything in the reverse direction, even aside from getting it to actually honor what you send it.

The IdP is free (and indeed expected) to reject requests with specific context classes that an SP may request if it has no way to satisfy them.

-- Scott