Does an Authentication Context URN actually reference an XML file?

["Costello, Roger L." <costello@mitre.org>]

Hi Folks,

 

I have a couple questions regarding Authentication Context:

 

1. Does an Authentication Context URN actually reference an XML file?

 

Suppose that I am an Authentication Authority, and I send you an assertion that contains this:

 

        <AuthnContext>

            <AuthnContextClassRef>

                urn:oasis:names:tc:2.0:ac:classes:PasswordProtectedTransport

            </AuthnContextClassRef>

        </AuthnContext>

 

Does that URN actually reference an XML file? 

 

Should I (the Authentication Authority) have created the XML file prior to sending you the assertion?

 

 

2. Now let me change hats and be the recipient of the above assertion. 

 

What should I do with that URN?  Should I go back the Authentication Authority and request that it send me the XML file? 

 

Or, should I skip getting the XML file and treat the URN as information itself that tells me, “The subject was authenticated through the presentation of a password over a protected session.”

 

What is the concept of operations (CONOPS) for the URN?

 

 

3. Let’s suppose that there really is an XML file that corresponds to the URN.

 

(This may sound odd, but …)  What is the root element of the XML file? 

 

Is this the root element:

 

<AuthenticationContextDeclaration> ,,, </AuthenticationContextDeclaration>

 

Or perhaps this is the root element:

 

<AuthMethod> … </AuthMethod>

 

Or perhaps something else?

 

What is the CONOPS?

 

 

Note: perhaps I have old documentation; there are large differences between it and the actual schemas.  /Roger