What is the SAML authentication context, and how do IdP and SP use it in opposite directions?
It describes the kind and strength of an authentication: the SP can state the context it requires in its request, and the IdP states the context it actually used in the assertion's AuthnContext.
"The user logged in" is not enough for a sensitive service; it matters how. The authentication context carries this information in both directions:
- SP to IdP (required context): in the
<AuthnRequest>, a<RequestedAuthnContext>says what the SP needs, for example "at least multi-factor", with a comparison ofexact,minimum,betterormaximum. - IdP to SP (used context): in the assertion,
<AuthnContext>with an<AuthnContextClassRef>says what actually happened. In the example it ishttps://stiam.gov.ch/aa/level3, an assurance level defined by the federation.
SAML predefines classes such as PasswordProtectedTransport (password over TLS), X509 or Smartcard, and federations often define their own level URIs. If the IdP cannot satisfy the requested context it must fail the request rather than quietly authenticate more weakly, and the SP should still check the returned class instead of trusting that its request was honoured.
Go deeper:
OASIS: Authentication Context for SAML V2.0 (PDF) — the predefined context classes and their schema.- SAML 2.0: Authentication Request Protocol (Wikipedia) — an AuthnRequest example including its options.