You can map authentication context values between the local and remote values in an OpenID Connect or a SAML 2.0 identity provider (IdP) connection.
This optional configuration overrides how authentication context values are communicated with partners in both the authentication or authorization requests and their responses. Any values that are not defined in this configuration are passed through as-is.
As needed, you can use an asterisk,
*, to match any values, a blank
value for a scenario where the partner or the local request does not specify an
authentication value, or both.
- Go to .
- Click the name of the connection to open it in the IdP Connection window.
- On the Activation & Summary tab, scroll down to the Protocol Settings section, then click Overrides.
- On the Overrides tab, specify the Local and Remote entry, then click Add.
Repeat the previous step to define additional mappings.
Click Edit, Update, or Cancel to make or undo a change to an existing entry. Click Delete or Undelete to remove an existing entry or cancel the removal request.
Click Save to complete the configuration.
Alternatively, click Next to carry on with the rest of the connection settings.
urn:oasis:names:tc:SAML:2.0:ac:classes:unspecifiedauthentication context. While the IdP is capable of authenticating its users using a Kerberos-based authentication system, a proprietary identity management system, and a few internal web portals, the authentication context values are different than what your application supports. The authentication context values from the IdP are as follows.
|Authentication method||AuthnContext values|
|Kerberos-based authentication system||
|Internal web portals||
|Proprietary identity management system||No authentication context information is provided|
The first entry maps
urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos. The second entry
maps any authentication context values including
urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified. The last entry
overrides the authentication value to
urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified in the event that
the assertion does not contain any authentication context information.