Ping MFA with Shibboleth IDP 5

[Cantor, Scott]

> I don't see any way to make MFA fail out of the box
> because they didn't send back a valid AuthnContext,
> other than adding an inlineScript to the MFA
> TransitionMap that tries to enforce it.

The proxy flow doesn't have that kind of enforcement, no.

What would be expected to happen is that the requirements for the SP (or that the IdP imposed on its end) would kick in at the very end when it finalizes authentication and determines if the result complies with the requested context(s).

The MFA context's isApplicable() method can perform that computation on the combination of results that are available, so running that in the script as mentioned is probably the closest, but even that "assumes" how the final result will be built, by merging everything, so it wouldn't know about a custom merging function being used (which is rare, but it's a feature).

> Is the correct way to handle this to have the SP enforce
> MFA?

If the SP is making the request then it has to also enforce, that's a given. But the IdP will fail the request anyway before it gets that far, it would return a SAML error with NoAuthnContext in the substatus.

-- Scott