Authentication Context Certificate Extension
Extracted elements (22)
The ASN.1 1988 module (Appendix A.1) is the normative module per PKIX working group policy for certificate-related specifications, even though a 2008 ASN.1 module is also provided for reference.
The <AttributeMapping> design intentionally covers only distinct, clear one-to-one relationships between SAML attributes and certificate subject attributes. Complex mapping situations (e.g., multiple SAML attributes mapping to one certificate attribute, or structured multivalued attributes) are explicitly noted as out of scope and deferred to extensions of the XML schema.
The extension was designed to enable scalable linking between SAML-authenticated identities and X.509 certificates, so that a relying party only needs to trust a list of CAs rather than maintain out-of-band knowledge about each CA's practices. All relationship information between the SAML subject and the certificate subject is embedded in the certificate itself.
If a SAML attribute value is present in an <AttributeMapping>, the corresponding certificate attribute value MAY differ in format and encoding (e.g., 'Sweden' in SAML versus 'SE' in the certificate countryName attribute).
If an application requires an authentication context and either the extension is absent or none of the provided authentication contexts can be used, the end-user certificate fails validation.
The extension MAY be marked critical. Applications encountering an unrecognized authentication context type in a non-critical extension must ignore it; in a critical extension, they must reject the certificate. This mirrors standard X.509 criticality handling.
When multiple <AttributeMapping> elements refer to the same certificate subject attribute or name form (due to multiple instances with values from different SAML attributes), no explicit matching rules guarantee unambiguous correspondence; applications MAY attempt value comparison but results are not guaranteed.
Applications that find an authentication context information type they do not understand MUST ignore it if the extension is non-critical, and MUST reject the certificate if the extension is marked critical.
Each <AttributeMapping> element MUST specify Type ('rdn', 'san', or 'sda') and Ref attributes, and MUST contain a <saml:Attribute> element with a Name attribute.
String representations of OIDs in the Ref attribute MUST be a sequence of integers separated by periods and MUST NOT contain any other characters (only ASCII numerals and periods).
The contextInfo XML document SHALL contain UTF-8-encoded XML per the schema in Appendix B, and MUST NOT include an XML header; only the root <SAMLAuthContext> element and its children are included.
The contextType field MUST contain a URI that identifies the context type as well as the data format and encoding of context information provided in contextInfo.
When present, the Authentication Context extension MUST include at least one AuthenticationContext element.
When the SAML context type URI (http://id.elegnamnden.se/auth-cont/1.0/saci) is specified as contextType, the associated XML data in contextInfo MUST be provided as a UTF-8-encoded XML document.
The <AuthContextInfo> element (optional) carries SAML authentication context attributes: IdentityProvider (required), AuthenticationInstant (required), AuthnContextClassRef (required), AssertionRef (optional), and ServiceID (optional).
The Authentication Context extension is defined as a SEQUENCE of one or more AuthenticationContext elements, each containing a contextType (UTF8String URI) and an optional contextInfo (UTF8String). The OID for this extension is id-ce-authContext under the e-legnamnden arc.
The <IdAttributes> element (optional) holds a sequence of one or more <AttributeMapping> elements, each mapping a certificate subject attribute or name form to a SAML attribute. Each mapping specifies a Type ('rdn', 'san', or 'sda') and a Ref.
The OID arc for this extension is: e-legnamnden OBJECT IDENTIFIER ::= { iso(1) member-body(2) se(752) 201 }; id-eleg-ce ::= { e-legnamnden 5 }; id-ce-authContext ::= { id-eleg-ce 1 }.
A relying party must understand the certificate policy under which the CA operates to determine whether a given certificate's authentication context provides a level of assurance higher than the minimum. Absent this understanding, the relying party must assume the lowest assurance level.
This extension allows a CA to outsource subject authentication to another trust infrastructure dynamically, so two certificates from the same issuer may carry different levels of assurance. A relying party unable to process the authentication context extension MUST assume the certificate was issued at the lowest allowed level of assurance declared by the CA's policy.
The AuthenticationContext ASN.1 structure has two fields: contextType (UTF8String, mandatory) carrying a URI, and contextInfo (UTF8String, OPTIONAL) carrying the encoded context data. The extension value is a SEQUENCE SIZE (1..MAX) of AuthenticationContext.
The SAML Authentication Context contextInfo payload is a UTF-8 XML string without an XML header declaration, containing only the <SAMLAuthContext> root element with child elements <AuthContextInfo> and <IdAttributes> per the XML schema namespace http://id.elegnamnden.se/auth-cont/1.0/saci.