I want to force reauthentication when a user signs a document using ForceAuthn and RequestedAuthnContext / AuthnContextClassRef (to bypass browser caching authentication) in the SAML request. Is it a good idea to save the authentication context class from the SAML response when the user logs in, and later, when the user needs to sign, specify the saved class as AuthnContextClassRef in the SAML request?

The idea is that the user will need to use the same authentication method for signing the document as when logging in. And there would be no need to configure the authentication context in the SP (with the risk of configuring something that the IdP doesn't support).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.