carry the proxy through as authenticationauthority #97
Conversation
|
OK guys pls review! |
There was a problem hiding this comment.
According to SAML Core 3.4.1.5.1 in the case of proxying :
The saml:AuthnStatement in the new assertion MUST include a saml:AuthnContext element containing a saml:AuthenticatingAuthority element referencing the identity provider to which the proxying identity provider referred the presenter. If the original assertion containssaml:AuthnContext information that includes one or more saml:AuthenticatingAuthority elements, those elements SHOULD be included in the new assertion, with the new element placed after them.
Assuming that your title is misleading and what we carry over is the original Issuer ( which should be the case with internal_response.auth_info.issuer ) I think this is not only a nice to have, but something we must be doing.
|
Yes the title is misleading and this is exactly what I'm talking about. |
This sets the AuthnStatement/AuthnContext/AuthenticatingAuthority to the proxied entityID. Might be useful.