<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Latha;
panose-1:2 11 6 4 2 2 2 2 2 4;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;
mso-fareast-language:EN-US;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-IN" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Hi Team,<br>
<br>
As part of our recent client engagement, we enabled SAML proxy for Shibboleth IDP and configured Okta as upstream IDP.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">In the SAML assertion issued by Shibboleth IDP to the downstream SP applications, we can observe that Okta’s authentication context class “<b>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</b>” is sent as classRef value.
We need to replace this value with “<a href="https://refeds.org/profile/mfa">https://refeds.org/profile/mfa</a>” value in SAML response generated by Shibboleth IDP as before otherwise some of the underlying SPs may fail SSO, considering this as invalid MFA
authentication context class reference<b>(<saml2:AuthnContextClassRef>).</b><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">While exploring the Shibboleth documentations we can find below article talking about
<b>authnContextTranslationStrategy</b> and <b>authnContextTranslationStrategyEx</b>, but there are no proper examples on how to use these with SSO profile and what bean and properties can be used together.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><a href="https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631686/ProfileConfiguration-SAML2SSO">ProfileConfiguration-SAML2SSO - Identity Provider 4 - Confluence</a><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b><span lang="EN-US">Our version: V4.3.3<o:p></o:p></span></b></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Kindly can you share with us any other Shibboleth documentation or example syntax to achieve the above translation?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks and Regards<br>
Kalidasan S<br>
Advisory - Senior Solution Advisor<br>
<span lang="EN-US" style="mso-ligatures:none;mso-fareast-language:EN-IN">Cyber IAM(Okta) | Deloitte US India Risk and Financial Advisory<o:p></o:p></span></p>
<p class="MsoNormal"><span lang="EN-US" style="mso-ligatures:none;mso-fareast-language:EN-IN"><a href="mailto:kalids@deloitte.com"><span style="color:#0563C1">kalids@deloitte.com</span></a> |
<a href="http://www.deloitte.com/"><span style="color:#0563C1">www.deloitte.com</span></a></span><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p>This message (including any attachments) contains confidential information intended for a specific individual and purpose, and is protected by law. If you are not the intended recipient, you should delete this message and any disclosure, copying, or distribution
of this message, or the taking of any action based on it, by you is strictly prohibited.</p>
<p>Deloitte refers to a Deloitte member firm, one of its related entities, or Deloitte Touche Tohmatsu Limited ("DTTL"). Each Deloitte member firm is a separate legal entity and a member of DTTL. DTTL does not provide services to clients. Please see www.deloitte.com/about
to learn more.</p>
<p>v.E.1</p>
</body>
</html>