Handling LOA-based authentication context classes in Shibboleth IdP

[Scott Cantor]

> 
> However, eIDAS SAML message format specification [2] mandates usage of authentication context classes mixing authentication and identity assurance levels:

That's a misuse of AuthnContext, but it isn't dissimilar in the end from cases where the authentication assurance level alone depends on the user, so it comes up just the same in a lot of MFA deployments where the effective policy for a service depends on a user or other context.

In such cases, the system is never going to just be able to do all that for you. The login flows have to be configured to handle "whatever they might potentially handle" and the rest is up to the MFA scripting rules to work out at runtime.

> AFAIK, 3 and 4 require non-trivial post-login processing, similar to subject canonicalization, and usage of scripted procedures. Or am I missing something ?

It's not generally done post-login, it's "during login", it's what the MFA flow is designed to address through dynamic behavior at runtime that the system can't deal with based on simple rules.

-- Scott