<div dir="ltr"><div class="gmail_extra">Closing the loop:</div><div class="gmail_extra"><br></div><div class="gmail_extra">The changes I described here seem to work to enable those without an explicit directory based allowed authN context to use password method to satisfy the SP requested PPT context.</div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Jul 7, 2015 at 5:27 PM, IAM David Bantz <span dir="ltr"><<a href="mailto:dabantz@alaska.edu" target="_blank">dabantz@alaska.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I'm starting to understand. Sorry to be a slow learner. I see that my MCB is configured to allow initial authN to pass through provided the SP doesn't have a requested context:<div><br></div>







<div><span>   </span><span><principalAuthnContextRequired></span><span>false</span><span></principalAuthnContextRequired></span></div><div><br></div><div>So I'm encountering my problem when the new SP requires PPT that I normally don't see because of that config.</div><div><br></div><div><br></div><div>I'm drawing users' authNcontexts from a mapped directory attribute (group membership).</div><div><br></div><div>So ... I should be able to add something like this to that resolver:</div><div>







<p><span>        </span><span><DefaultValue></span><span>urn:oasis:names:tc:SAML:2.0:ac:classes:<span class="il">PasswordProtectedTransport</span></span><span></DefaultValue></span></p></div><div>to provide an allowed authNcontext for (most) users with no other context explicitly named.</div><div><br></div><div>Combined with the following to enable <span class="il">password</span> to satisfy requested PPT.</div><div>







<p><span class=""><span>     </span><span><</span><span>context</span><span> </span><span>name</span><span>=</span><span>"urn:oasis:names:tc:SAML:2.0:ac:classes:<span class="il">Password</span>"</span><span> </span><span>method</span><span>=</span><span>"<span class="il">password</span>"</span><span>><br></span><span>            </span><span><allowedContexts><br></span></span><span>                </span><span><</span><span>context</span><span> </span><span>name</span><span>=</span><span>"<a href="https://iam.alaska.edu/trac/wiki/mfa" target="_blank">https://iam.alaska.edu/trac/wiki/mfa</a>"</span><span> /><br></span><span class=""><span>                </span><span><</span><span>context</span><span> </span><span>name</span><span>=</span><span>"urn:oasis:names:tc:SAML:2.0:ac:classes:<span class="il">PasswordProtectedTransport</span>"</span><span> /><br></span><span>            </span><span></allowedContexts></span></span></p><p><span>    </context></span></p></div></div></blockquote></div><br><br></div></div>