<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="color: rgb(0, 0, 0); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important;">Hi
Neil,</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="color: rgb(0, 0, 0); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important;"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="color: rgb(0, 0, 0); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important;">Have
you tried </span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="color: rgb(0, 0, 0); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important;"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0); background-color: rgb(255, 255, 255);">
<span style="color: rgb(0, 0, 0); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important;"><bean
parent="SAML2.SSO" p:<span style="color: rgb(23, 43, 77); font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Noto Sans", Ubuntu, "Droid Sans", "Helvetica Neue", sans-serif; font-size: 16px; letter-spacing: -0.08px; text-align: left; background-color: rgba(255, 255, 255, 0.6); display: inline !important;">authnContextComparison="exact"</span>></span><br>
<span style="color: rgb(0, 0, 0); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important;">
<property name="defaultAuthenticationMethods"></span><br style="color: rgb(0, 0, 0); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255);">
<span style="color: rgb(0, 0, 0); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important;">
<list></span><br style="color: rgb(0, 0, 0); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255);">
<span style="color: rgb(0, 0, 0); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important;">
<bean parent="shibboleth.SAML2AuthnContextClassRef"</span><br style="color: rgb(0, 0, 0); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255);">
<span style="color: rgb(0, 0, 0); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important;">
c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" /></span><br style="color: rgb(0, 0, 0); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255);">
<span style="color: rgb(0, 0, 0); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important;">
</list></span><br style="color: rgb(0, 0, 0); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255);">
<span style="color: rgb(0, 0, 0); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important;">
</property></span><br style="color: rgb(0, 0, 0); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255);">
<span style="color: rgb(0, 0, 0); font-family: "Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif; font-size: 14.6667px; background-color: rgb(255, 255, 255); display: inline !important;"></bean></span><br>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
in your relying-party.xml?</div>
<div id="Signature">
<div>
<div id="divtagdefaultwrapper" dir="ltr" style="font-size: 12pt; font-family: Calibri, Helvetica, sans-serif; color: rgb(0, 0, 0);">
<div style="font-family:Tahoma; font-size:13px"><font size="2"><font face="Courier New">--<br>
Aterea Brown, AUT University<br>
Cybersecurity, ICT<br>
Email: atbrown@aut.ac.nz Phone: 9219999 x 6523</font></font></div>
</div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of McLennan, Neil R <n.mclennan@imperial.ac.uk><br>
<b>Sent:</b> Saturday, 27 November 2021 2:12 AM<br>
<b>To:</b> 'Shib Users' <users@shibboleth.net><br>
<b>Subject:</b> Changing IDP4 SAML Authentication RequestedAuthnContext Comparison value</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">Has anybody worked out how to alter the RequestedAuthnContext for SAML authentication so that <saml2p:RequestedAuthnContext Comparison="exact"> ?<br>
<br>
As per the useful <a href="https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fspaces%2FIDP4%2Fpages%2F1265631678%2FRelyingPartyConfiguration&data=04%7C01%7Catbrown%40aut.ac.nz%7C90cddda4048244a638d108d9b0de7504%7C5e022ca15c044f878db7d588726274e3%7C1%7C0%7C637735292245553131%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=4f9NFeBFW8bEPhvaZu1Mw2WwncUzGeWI0S4p%2F0ErIZw%3D&reserved=0">
https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fspaces%2FIDP4%2Fpages%2F1265631678%2FRelyingPartyConfiguration&data=04%7C01%7Catbrown%40aut.ac.nz%7C90cddda4048244a638d108d9b0de7504%7C5e022ca15c044f878db7d588726274e3%7C1%7C0%7C637735292245553131%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=4f9NFeBFW8bEPhvaZu1Mw2WwncUzGeWI0S4p%2F0ErIZw%3D&reserved=0</a>
I have updated the relying party for the SAML authentication hoping it might override <saml2p:RequestedAuthnContext Comparison="minimum"> however it remains the same<br>
<br>
Authentication request into Shibboleth<br>
<br>
<saml2p:RequestedAuthnContext Comparison="minimum"><br>
<saml2:AuthnContextClassRef xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef><br>
</saml2p:RequestedAuthnContext><br>
<br>
Outgoing Authentication request from Shibboleth remains as <br>
<br>
<saml2p:RequestedAuthnContext Comparison="minimum"><br>
<saml2:AuthnContextClassRef xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef><br>
</saml2p:RequestedAuthnContext><br>
<br>
What am I missing in the Relying Party configuration for SAML authentication? <br>
<br>
<bean parent="RelyingPartyByName" c:relyingPartyIds="<a href="https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsts.windows.net%2Fxxxxxxxxxxxxxxx%2F&data=04%7C01%7Catbrown%40aut.ac.nz%7C90cddda4048244a638d108d9b0de7504%7C5e022ca15c044f878db7d588726274e3%7C1%7C0%7C637735292245553131%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=jwoeFgEtcBpnd%2B%2Bwo3K0C0CUF%2BIn0YZWWIvhWffbcCo%3D&reserved=0">https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fsts.windows.net%2Fxxxxxxxxxxxxxxx%2F&data=04%7C01%7Catbrown%40aut.ac.nz%7C90cddda4048244a638d108d9b0de7504%7C5e022ca15c044f878db7d588726274e3%7C1%7C0%7C637735292245553131%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=jwoeFgEtcBpnd%2B%2Bwo3K0C0CUF%2BIn0YZWWIvhWffbcCo%3D&reserved=0</a>"><br>
<property name="profileConfigurations"><br>
<list><br>
<bean parent="SAML2.SSO" p:disallowedFeatures-ref="SAML2.SSO.FEATURE_AUTHNCONTEXT"><br>
<property name="defaultAuthenticationMethods"><br>
<list><br>
<bean parent="shibboleth.SAML2AuthnContextClassRef"<br>
c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" /><br>
</list><br>
</property><br>
</bean><br>
</list><br>
</property><br>
</bean><br>
<br>
However <br>
<br>
Authentication request into Shibboleth<br>
<br>
<saml2p:RequestedAuthnContext Comparison="minimum"><br>
<saml2:AuthnContextClassRef xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef><br>
</saml2p:RequestedAuthnContext><br>
<br>
Outgoing Authentication request from Shibboleth remains as <br>
<br>
<saml2p:RequestedAuthnContext Comparison="minimum"><br>
<saml2:AuthnContextClassRef xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml2:AuthnContextClassRef><br>
</saml2p:RequestedAuthnContext><br>
<br>
Regards<br>
<br>
Neil McLennan<br>
-- <br>
For Consortium Member technical support, see <a href="https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=04%7C01%7Catbrown%40aut.ac.nz%7C90cddda4048244a638d108d9b0de7504%7C5e022ca15c044f878db7d588726274e3%7C1%7C0%7C637735292245553131%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=sTWwy0Dyskka%2Bo7MFyFN74U59E4fZ9cBTy2DtwDxYXg%3D&reserved=0">
https://apc01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=04%7C01%7Catbrown%40aut.ac.nz%7C90cddda4048244a638d108d9b0de7504%7C5e022ca15c044f878db7d588726274e3%7C1%7C0%7C637735292245553131%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=sTWwy0Dyskka%2Bo7MFyFN74U59E4fZ9cBTy2DtwDxYXg%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>