Thomas Wisniewski wrote:
>
> It would seem ok, but a bit awkward.
>
why?
>
> Would your example be changed to
>
> <RequestedAuthnContexts RACComparison="all">
> <saml:AuthnContexxtClassRef...></..>
> <RequestedAuthnContexts RACComparison="exact">
> <saml:AuthnContexxtClassRef...></..>
> </RequestedAuthnContexts>
> </RequestedAuthnContexts>
>
> Is that whay you're trying to say?
>
the example wouldn't change. I was proposing leaving the schema as is,
merely loosening the text that disallowed multiple
<RequestedAuthnContexts> elements in a message
>
> Why not just have a top level (maxOccurs="1") RequestedAuthnContext
> element that then defines an unlimited number of RequestedAuthnContext
> elements that have a comparison operator attribute and contain the
> saml AuthnContextClassRef element.
>
So, something like
<complexType name="RequestedAuthnContextsType">
<sequence>
<element ref="RequestedAuthnContext" maxOccurs="unbounded"/>
</sequence>
</complexType>
<complexType name="RequestedAuthnContextType">
<sequence>
<element ref="saml:AuthnContextClassRef" maxOccurs="unbounded"/>
</sequence>
<attribute name="RACComparison" type="anyURI" use="optional"/>
</complexType>
we wanted the comparison operator on the top-level element as well.
Given that, we tried to minimize the number of new elements by
introducing the nesting.
Additionally, the above forces an SP to insert the
<RequestedAuthnContext> element even when all they want to do is give a
list of <AuthnContextClassRef>s they want combined.
>
> Do I need to satisfy all the RequestedAuthnContext elements in order
> to satisfy the RequestedAuthnContexts element? I.e., in your example
> you say this is an AND -- so I assume the answer is yes. I.e., you
> cannot express that you are requesting either AC-1 or AC-2 (exactly)
> in your schema.
>
the 'all' on the outermost <RequestedAuthnContexts> in the example
requires you to satisfy both. We don't have an 'either' but neither does
core SAML.
>
-
Paul Madsen e:paulmadsen @ ntt-at.com
NTT p:613-482-0432
m:613-302-1428
aim:PaulMdsn5
web:connectid.blogspot.com
