<div dir="ltr">It mostly works (though it may be a config issue on my end). When I do an SP initiated SSO, there's an authncontextclassref in the authnrequest of urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport and the same authncontextclassref is in the assertion in the response. The same IdP however with IdP initiated gives me the authncontextclassref of urn:oasis:names:tc:SAML:2.0:ac:classes:Password. Why are they different?<div><br></div><div>Thanks</div><div>Marc</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Mar 13, 2015 at 9:25 AM, Marvin Addison <span dir="ltr"><<a href="mailto:marvin.addison@gmail.com" target="_blank">marvin.addison@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_quote"><span class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><a href="https://wiki.shibboleth.net/confluence/display/SHIB2/IdPUnsolicitedSSO" target="_blank">https://wiki.shibboleth.net/<u></u>confluence/display/SHIB2/<u></u>IdPUnsolicitedSSO</a><br>
<br>
I'll be surprised if it doesn't work.<br></blockquote><div><br></div></span><div>Indeed it works fine -- do it all the time in testing with our v3 instance.</div><span class="HOEnZb"><font color="#888888"><div><br></div><div>M<a href="mailto:users-unsubscribe@shibboleth.net" target="_blank"></a><br>
</div><div><br></div></font></span></div></div>
<br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div>