<div dir="ltr"><div dir="ltr"><br></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Hi Jeff,<br>
<br>
>From what I can see the snippet on the wiki page is mapping between AuthnContextClassRefs but our observation is that Azure emits that "multipleauthn" assertion as an Attribute in the AttributeStatement rather than in the AuthnContext:<br>
<br>
> <AttributeStatement><br>
> ...<br>
>     <Attribute Name="<a href="http://schemas.microsoft.com/claims/authnmethodsreferences" rel="noreferrer" target="_blank">http://schemas.microsoft.com/claims/authnmethodsreferences</a>"><br>
>         <AttributeValue><a href="http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password" rel="noreferrer" target="_blank">http://schemas.microsoft.com/ws/2008/06/identity/authenticationmethod/password</a></AttributeValue><br>
>         <AttributeValue><a href="http://schemas.microsoft.com/claims/multipleauthn" rel="noreferrer" target="_blank">http://schemas.microsoft.com/claims/multipleauthn</a></AttributeValue><br>
>     </Attribute><br>
> ...<br>
<br>
> </AttributeStatement><br>
> ...<br>
> <AuthnStatement AuthnInstant="..." SessionIndex="..."><br>
>     <AuthnContext><br>
>         <AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</AuthnContextClassRef><br>
>     </AuthnContext><br>
> </AuthnStatement><br>
<br></blockquote><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Am I barking up the wrong tree or have you "done something" to the Azure IdP end to get it to emit this as an AuthnContextClassRef?<br></blockquote><div> </div><div>We didn't make any changes to Azure, but its AuthnContext behavior seems to go with returning the minimum requested level of authn to the SP, defaulting to password, at least where password is used in the MFA stack. <br></div><div><br></div><div>So if your SP doesn't request a particular level of authn and your user does MFA, Azure still sends back a password AuthnContext.  If the SP requests MFA (<a href="http://schemas.microsoft.com/claims/multipleauthn" style="background-image:none;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;text-decoration-line:none;border-radius:0px;border:0px;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(0,51,102)">http://schemas.microsoft.com/claims/multipleauthn</a>), and the user successfully performs it, Azure will return <a href="http://schemas.microsoft.com/claims/multipleauthn" style="background-image:none;background-position:initial;background-size:initial;background-repeat:initial;background-origin:initial;background-clip:initial;text-decoration-line:none;border-radius:0px;border:0px;height:auto;line-height:20px;margin:0px;outline:0px;overflow:visible;padding:0px;vertical-align:baseline;width:auto;box-sizing:content-box;font-family:Consolas,"Bitstream Vera Sans Mono","Courier New",Courier,monospace;font-size:14px;min-height:inherit;white-space:nowrap;color:rgb(0,51,102)">http://schemas.microsoft.com/claims/multipleauthn</a>.  You can then map it to the REFEDS equivalent to send back to the SP.</div><div></div><div><br></div><div>  authnmethodsreferences is one of the default attributes Azure sends to SP's I believe so that ADFS operators can do MFA requirements in their ADFS way. I don't believe it impacts Shibboleth's IdP behavior in any meaningful way.<br></div><div><br></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<br>
Thanks,<br>
-- <br>
Matthew Slowe (GPG: 0x6BE0CF7D04600314)<br>
Senior Technical Consultant and Support specialist - Trust & Identity, Jisc<br>
Team: 0300 300 2212, option 2<br>
Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG<br>
<br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><div dir="ltr">Jeffrey Williams </div><div dir="ltr">Identity & Access Engineer<br>Identity & Access Services<br><a href="https://its.uncg.edu" target="_blank">https://its.uncg.edu</a></div></div><div dir="ltr"><br></div><div dir="ltr"><img src="https://uncgcdn.blob.core.windows.net/email/UNCGLogo.png"><br></div></div></div></div></div></div></div></div></div></div>