Adds default_aal to service_provider (LG-3825)#4605
Merged
Conversation
zachmargolis
approved these changes
Jan 25, 2021
|
|
||
| def aal3_sp1_saml_settings | ||
| settings = saml_settings.dup | ||
| settings.authn_context = nil |
Contributor
There was a problem hiding this comment.
should this be something that sets AAL3? Or does it come from the issuer?
Contributor
Author
There was a problem hiding this comment.
Yes, this is a case where the semantics have changed. The default settings request an AAL2 auth, and would have returned AAL3 given aal: 3. Now that request would return AAL2 since the request trumps the default. These settings are now used in a test of the default (spec/features/saml/aal3_required_spec), so we need to not make an AAL request at all.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
As an administrator of an application, i want to be able to set the default authn context (AAL), so that I am not hamstrung by middleware that does not allow me to assert it as part of the authentication request.
Previously, it was unclear if the aal level set on the SP was required or the default, we are now asserting that it is the default and will allow partners to set the default AAL in the dashboard.
This is the first of two PR's to migrate from the confusing
aalfield to the more explicitdefault_aalfield - a following PR will remove the originalaalfield.