Shibboleth Developers

[Paul Hethmon <>]

Title: Changing AuthnContext

I’ve got a requirement to change the AuthnContext declaration to reflect the actual type of authentication device my user utilized. My back-end authentication system transparently handles many different types of devices and fixed passwords (OTP, fixed, SMS delivered, etc). I can bubble that information up to the appropriate level in my Shib login handler. So my question is whether the login handler can actually change the value reported in the SAML response? I certainly see how I configure the server to have my handler “handle” the appropriate types. So am I looking at the right place or do I have to go up higher in Shib to implement something like this?

Thanks,

Paul


-----
Paul Hethmon
Chief Software Architect
Clareity Security, LLC
865.824.1350 - office
865.250.3517 - mobile
www.clareitysecurity.com
-----

Give a man a fire and he's warm for the day. But set fire to him and he's warm for the rest of his life.

 -- Terry Pratchett, Discworld