9

If I interpret the SAML 2.0-protocol correctly you can have multiple AuthnStatements. What is the purpose of this? I cannot see a use case of having multiple AuthnStatements really.

Improve this question

2 Answers 2

Reset to default
0

As per SAML 2.0 specifications, an authentication statement specifies that the assertion subject was authenticated by a particular means at a particular time.

One of the use cases with some IDPs is when a multi-factor authentication has been performed. In that case, each authentication statement specifies one step in the authentication process. For example -

  1. AuthnStatement one - Subject was authenticated via password at 12:34:35
  2. AuthnStatement two - Subject was authenticated via OTP/Biometric at 12:34:56

SAML 2.0 has a vast set of features but not every implementations support all of them. Most implementations support only single authentication statement which covers a major use case.

Improve this answer
-1

Perhaps this easily googled answer regarding the assertions of the SAML spec is what you want https://en.wikipedia.org/wiki/SAML_2.0#SAML_2.0_Assertions

Improve this answer
2
  • It would be great if you could expand on this answer.
    – Neil Smithline
    Nov 2, 2015 at 4:57
  • Is there any chance you could expand even further? I'm not following you at all really.
    – Robert
    Nov 3, 2015 at 9:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.