openconextapps / simplesamlphp-module-stepupsfo Goto Github PK

The AuthnContextClassRef that is sent to an SP, is not affected by whether the stepupsfo module is used.
For example without this module the SP will receive:

<saml:AuthnContext
<saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml:AuthnContextClassRef>
</saml:AuthnContext>

But when the stepupsfo module is used, and the user successfully did MFA, the AuthnContextClassRef would be exactly the same. This prevents SPs to can selectively bypass their own MFA implementation from doing so.
Gitlab is a example of such an SP: https://docs.gitlab.com/ee/integration/saml.html#bypass-two-factor-authentication

As a feature request, the stepupsfo module should be forwarding the AuthnContextClassRef that it received from the SFO IdP.

Currently SFO can be enabled for the entire IdP, or for specific SPs.
I would like to enable it for a subset of users/groups for a specific SP first.
Is there a way to have this more fine grained control?