<p dir="ltr">Ok so upgrading to 3.1 should eliminate this issue?</p>
<div class="gmail_quote">On Mar 13, 2015 10:08 AM, "Cantor, Scott" <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">On 3/13/15, 10:04 AM, "Tom Scavo" <<a href="mailto:trscavo@gmail.com">trscavo@gmail.com</a>> wrote:<br>
<br>
>On Fri, Mar 13, 2015 at 9:33 AM, Marc Boorshtein <<a href="mailto:mboorshtein@gmail.com">mboorshtein@gmail.com</a>> wrote:<br>
>> It mostly works (though it may be a config issue on my end). When I do an<br>
>> SP initiated SSO, there's an authncontextclassref in the authnrequest of<br>
>> urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport and the<br>
>> same authncontextclassref is in the assertion in the response. The same IdP<br>
>> however with IdP initiated gives me the authncontextclassref of<br>
>> urn:oasis:names:tc:SAML:2.0:ac:classes:Password. Why are they different?<br>
><br>
>I'm not sure why you expect them to be the same. If you don't ask for<br>
>one, you get what you get.<br>
<br>
They're different in 3.0 due to a quirk that I added a workaround for in 3.1 to favor PPT over P when both are "valid" for the response. The same login flows support both contexts, so it has to pick one and Ian noted the issue. We have a weighting hook now to favor one over another when they're otherwise equivalently valid to send back.<br>
<br>
V2 was more limited and only really supported one context at a time coming back from a method, so it didn't have to worry about picking one.<br>
<br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>