AuthnContext check in IdP response

[Guillaume Rousse]

Hello, here is yet another LOA-related question.

The examples given on this page explain how to require usage of a 
specific AuthnContext in SAML request, and also how to check the answer 
correctness, using Apache server authorization directives:
https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2114781453/Requiring+Multi-Factor+Authentication

This other documentation, from Microsoft, also show a similar situation, 
this time with multiple allowed AuthnContext:
https://learn.microsoft.com/en-us/answers/questions/5727558/how-to-specify-an-authncontextclassref-in-a-saml-r#example-shibboleth-sp-apache-config

Is this a good practice for a SP requiring a specific authContext to 
also explicitely check IdP response ? It seems simpler to consider than 
if you don't trust this IdP behavior, you may as well not trust it at 
all, and disallow any kind of interaction with it.

And if it's a defense in depth issue, why isn't this check automatically 
get enforced by Shibboleth SP itself ? Given it may be non-trivial 
checking the result of requests using comparaison operators, such as 
"https://refeds.org/profile/sfa or better", this would probably better 
handled in SAML implementation than delegated to the web server, or the 
client application.

Regards.
-- 
Guillaume Rousse
Direction des Services Applicatifs
RENATER - Paris

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4330 bytes
Desc: Signature cryptographique S/MIME
URL: <http://shibboleth.net/pipermail/users/attachments/20261106/9b0d7791/attachment.p7s>