Re: [security-services] Groups - authentication-context.pdf uploaded

[Jeff Hodges <Jeff.Hodges@Sun.COM>]

Reid, Irving wrote:
> 
> The way I look at it, the new Authn Context proposal is a workaround for the
> fact that we chose too restrictive a schema for the "authentication method"
> field in SAML 1.0.

correct.

> It's not being used to attest to the strength of the _assertion_; it's being
> used, in the context of a profile or set of terms-of-service agreed to by
> the asserting and relying parties, to convey more details about how the
> asserting party authenticated the subject.

correct.

> Said profile or terms-of-service can define a specific schema for the
> Authentication Context, and a concept of "strength of authentication" based
> on instances of that schema.

correct, /but/ we try very hard to not have a notion of "strength" in the spec 
itself, because "strength of authn is in the eye of the relying party (aka 
beholder)".

So, in the context of a trust circle or whatever you want to call it, there may 
  be agreed-upon notions of "quality of authn", and particular expressions of 
said quality expressed via authn context components.

JeffH