Flow Condition To Authentication Context Mapping
Description
Uses a specific Authentication Context if the Flow Condition can be satisfied.
May be used by
Properties
Flow Condition (
flowCondition) Description
If this condition is fulfilled, the configured Authentication Context will be used in the Assertion (AuthnContextClassRef element).
Attributes
Plugin-Link
Mandatory
Assignable plugins
Account Linking Required Red Flag Condition Active Authentication Method Airlock 2FA Device Deletion Possible Airlock 2FA was used for login (Transaction Approval only) Always False Always True Boolean Condition Cronto Activation Possible Cronto Activation Required Cronto Device Removal Possible Cronto Letter Order Condition Cronto was used for login (Transaction Approval only) CrontoSign Swiss Push Activation Possible Email OTP was used for login (Transaction Approval only) FIDO Credential Removal Possible FIDO was used for login (Transaction Approval only) First Usage of Device Has Cronto Account Has Cronto Device Has Device Token Has Email Address Has FIDO Credential Has Matching Role Has Matrix Card Has OATH OTP Token Has Password Has Suitable Airlock 2FA Device Has Tag Has Vasco OTP Token Has mTAN Activation Letter Has mTAN Token IdP-Initiated SSO Flow On SP Logical AND Logical NOT Logical OR Matching Username Never Migrate Possible New Device Condition Next Authentication Method-based Migration Condition OAuth 2.0 Authorization Code Grant In Progress OIDC prompt=none Condition Password Letter Order Interval Condition Public Self-Service Allowed Condition Red Flag Raised Request Has SSO Ticket Step Activated String Regex Condition User Attribute Is Unique User Identified User Represented Condition Vasco Activation Possible mTAN Number Changed mTAN Number Deletion Possible mTAN Number Registration Possible mTAN was used for login (Transaction Approval only)
Authentication Context (
authnContextUri) Description
The Authentication Context URI to be used if the configured flow condition is satisfied.
The available context classes are configured in the IDP extended metadata under the attribute "idpAuthncontextClassrefMapping". Only URIs in that list are valid to be set here.
Attributes
String
Mandatory
Suggested values
urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol, urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocolPassword, urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos, urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorUnregistered, urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorUnregistered, urn:oasis:names:tc:SAML:2.0:ac:classes:MobileOneFactorContract, urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract, urn:oasis:names:tc:SAML:2.0:ac:classes:Password, urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport, urn:oasis:names:tc:SAML:2.0:ac:classes:PreviousSession, urn:oasis:names:tc:SAML:2.0:ac:classes:X509, urn:oasis:names:tc:SAML:2.0:ac:classes:PGP, urn:oasis:names:tc:SAML:2.0:ac:classes:SPKI, urn:oasis:names:tc:SAML:2.0:ac:classes:XMLDSig, urn:oasis:names:tc:SAML:2.0:ac:classes:Smartcard, urn:oasis:names:tc:SAML:2.0:ac:classes:SmartcardPKI, urn:oasis:names:tc:SAML:2.0:ac:classes:SoftwarePKI, urn:oasis:names:tc:SAML:2.0:ac:classes:Telephony, urn:oasis:names:tc:SAML:2.0:ac:classes:NomadTelephony, urn:oasis:names:tc:SAML:2.0:ac:classes:PersonalTelephony, urn:oasis:names:tc:SAML:2.0:ac:classes:AuthenticatedTelephony, urn:oasis:names:tc:SAML:2.0:ac:classes:SecureRemotePassword, urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient, urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken, urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified
YAML Template (with default values)
type: Saml2FlowConditionToAuthnContextMapping
id: Saml2FlowConditionToAuthnContextMapping-xxxxxx
displayName:
comment:
properties:
authnContextUri:
flowCondition: