Hi Lennart,

here are defining options for saml2, where you can also find your option: https://www.microfocus.com/documentation/access-manager/5.0/admin/bvdbfae.html

For example, a service provider sends an authentication request (authnrequest) to a remote identity provider. The request contains the AuthnContextClassRef attribute. The local identity provider (Identity Server) performs the following actions:

But you have to check, that your identity provider has the same attribute in properties, like stated here:

https://www.netiq.com/documentation/access-manager-45-appliance/admin/data/b1ax7qoc.html#defineoption

How do you have your IDP configured, if you are using one?

Also there is a possibility of using option "SAML2 REQUEST IGNORE AUTHCONTEXT" and setting it to true on Service provider, but than it can happen, that your service provider is not happy with the response and throws an error (that is what Misrosoft does for example).

Kind regards,

Sebastian Novak

Hi Lennart,

here are defining options for saml2, where you can also find your option: https://www.microfocus.com/documentation/access-manager/5.0/admin/bvdbfae.html

For example, a service provider sends an authentication request (authnrequest) to a remote identity provider. The request contains the AuthnContextClassRef attribute. The local identity provider (Identity Server) performs the following actions:

But you have to check, that your identity provider has the same attribute in properties, like stated here:

https://www.netiq.com/documentation/access-manager-45-appliance/admin/data/b1ax7qoc.html#defineoption

How do you have your IDP configured, if you are using one?

Also there is a possibility of using option "SAML2 REQUEST IGNORE AUTHCONTEXT" and setting it to true on Service provider, but than it can happen, that your service provider is not happy with the response and throws an error (that is what Misrosoft does for example).

Kind regards,

Sebastian Novak

Hello Sebastian,

thanks for your reply.

Yeah I have done the way that I understand documentation, I got a setup where a remote SP (my Nam lab box) is set to request a specific authncontextclassref (http://id.elegnamnden.se/loa/1.0/loa3) and Context Compariso=exact. So authn request looks like this

<samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Consent="urn:oasis:names:tc:SAML:2.0:consent:unavailable" ForceAuthn="false" ID="idbSH0X2x27_hce1zkxLu92_OUInY" IsPassive="false" IssueInstant="2024-10-22T06:25:12Z" ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" Version="2.0">
    <saml:Issuer>https://nam.domain.com/nidp/saml2/metadata</saml:Issuer>
    <samlp:NameIDPolicy Format="urn:oasis:names:tc:SAML:2.0:nameid-format:transient"/>
    <samlp:RequestedAuthnContext Comparison="exact">
        <saml:AuthnContextClassRef>http://id.elegnamnden.se/loa/1.0/loa3</saml:AuthnContextClassRef>
    </samlp:RequestedAuthnContext>
</samlp:AuthnRequest>

In the SP configuration in NAM acting as both IDP and SP I have this specified as option

SAML2 CUSTOM AUTHNCONTEXT CLASS REF LIST=http://id.elegnamnden.se/loa/1.0/loa3

Have also tried with and without stepup contract in SP configuration, created a contract with Satisfiable by External Provider=true, Requested by=use types and allowable class set to http://id.elegnamnden.se/loa/1.0/loa3 and no method specified.

I have also done the remote IDP configuration and set the option

SAML2 CUSTOM AUTHNCONTEXT CLASS REF LIST=id.elegnamnden.se/.../loa3

and set Requested by: use types (but no type specified) and context comparison level to exact

I'm aware of the functionality regarding "SAML2 REQUEST IGNORE AUTHCONTEXT"

Thanks

/Lennart