<html><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; ">Tom,<div><br></div><div><div><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; ">Can I assume that e.g. performing delegated SSO (CAS over https against<br>Kerberos) satisfies the definition of "protected session" for<br>PasswordProtectedTransport?<br></span></blockquote><div><br></div><div>I think that should certainly qualify, yes. It would be nice if the specification did say a bit more about that, but I don't know whether a very good encompassing definition could be easily written given the nuances of the wide variety of authentication techniques out there in the world. I wasn't there for the writing of the spec and dunno whether this was wrestled over; maybe Scott will chime in.</div><br><blockquote type="cite"><span class="Apple-style-span" style="border-collapse: separate; color: rgb(0, 0, 0); font-family: Helvetica; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: 2; text-align: -webkit-auto; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; -webkit-text-decorations-in-effect: none; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px; font-size: medium; ">I ask because, as others apparently have, we've been wrestling with<br>service-now.com. The admin interface doesn't seem to allow one to turn<br>off RequestedAuthnContext in the AuthnRequest, so the only apparent (and<br>seemingly ugly) workaround is to add PasswordProtectedTransport to my<br>IdP's LoginHandler (handler.xml).</span></blockquote></div><br></div><div>It's probably not a bad idea to have it in there anyway, as you do in fact perform authentication by using a password over protected transport. It's unfortunate that it's mandatory in this instance but I don't consider this ugly nor a workaround.</div><div><br></div><div>Hope this helps,</div><div>Nate.</div></body></html>