<div dir="ltr">If WebEx is not sending a RequestedAuthnContext then it should not try to enforce a value returned in the SAMLResponse. I have this same problem with <a href="http://research.gov">research.gov</a>. My advice is to either find some way for WebEx to request PasswordProtectedTransport or remove the check for PasswordProtectedTransport. <div><br></div><div>Dave</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Feb 5, 2015 at 3:10 PM, Keith, Christopher <span dir="ltr"><<a href="mailto:christopher_keith@brown.edu" target="_blank">christopher_keith@brown.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Not sure if anyone who is using the MCB is also using Shibboleth with Webex.<div><br></div><div>Webex has an SSO configuration console and one of the options is AuthnContextClassRef. </div><div><br></div><div>I have this configured to be:</div><div>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</div><div><div><br></div><div>My MCB is configured to allow DUO to satisfy this context. </div><div><br></div>
<p><context name="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" method="passwordProtectedTransport"><br> <allowedContexts><br> <context name="<a href="http://brown.edu/duo" target="_blank">http://brown.edu/duo</a>" /><br> </allowedContexts><br></context></p><div><br></div><div> When I authenticate, my IDP generates an assertion with "<a href="http://brown.edu/duo" target="_blank">http://brown.edu/duo</a>" as my authentication context.</div><div><br></div><div>Webex rejects this because it does not match the configured value.</div><div><br></div><div>When I looked closer at the authentication request, I noticed that Webex does not actually include the configured AuthnContextClassRef in its authentication request in a RequestedAuthnContext element. In fact, it does not include a RequestedAuthnContext element at all.</div><div><br></div><div>I am trying to figure out if this is a configuration issue on my part or an implementation issue with Webex.</div><div><br></div><div>Thanks.</div><span class="HOEnZb"><font color="#888888"><div><br></div>-- <br><div><div dir="ltr">Christopher Keith '12 ScM<br>Associate Director<div>Integration & Identity Services</div><div>Computing and Information Services<br>Brown University<br><a href="tel:%28401%29%20863-1153" value="+14018631153" target="_blank">(401) 863-1153</a></div></div></div>
</font></span></div></div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature">David Langenberg<div>Identity & Access Management</div><div>The University of Chicago</div></div>
</div>