lasso_saml20_login_must_authenticate(LassoLogin *login)
{
	LassoSamlp2AuthnRequest *request;
	gboolean matched = TRUE;
	GList *assertions = NULL;
	LassoProfile *profile = &login->parent;

	if (! LASSO_IS_SAMLP2_AUTHN_REQUEST(profile->request))
		return FALSE;

	request = LASSO_SAMLP2_AUTHN_REQUEST(profile->request);
	if (request->ForceAuthn == TRUE && request->IsPassive == FALSE)
		return TRUE;

	if (request->RequestedAuthnContext) {
		char *comparison = request->RequestedAuthnContext->Comparison;
		GList *class_refs = request->RequestedAuthnContext->AuthnContextClassRef;
		char *class_ref;
		GList *t1, *t2;
		int compa = -1;

		if (comparison == NULL || lasso_strisequal(comparison,"exact")) {
			compa = 0;
		} else if (lasso_strisequal(comparison,"minimum")) {
			message(G_LOG_LEVEL_CRITICAL, "'minimum' comparison is not implemented");
			compa = 1;
		} else if (lasso_strisequal(comparison,"better")) {
			message(G_LOG_LEVEL_CRITICAL, "'better' comparison is not implemented");
			compa = 2;
		} else if (lasso_strisequal(comparison,"maximum")) {
			message(G_LOG_LEVEL_CRITICAL, "'maximum' comparison is not implemented");
			compa = 3;
		}

		if (class_refs) {
			matched = FALSE;
		}

		assertions = lasso_session_get_assertions(profile->session, NULL);
		for (t1 = class_refs; t1 && !matched; t1 = g_list_next(t1)) {
			class_ref = t1->data;
			for (t2 = assertions; t2 && !matched; t2 = g_list_next(t2)) {
				LassoSaml2Assertion *assertion;
				LassoSaml2AuthnStatement *as = NULL;
				char *method;
				GList *t3;

				if (LASSO_IS_SAML2_ASSERTION(t2->data) == FALSE) {
					continue;
				}

				assertion = t2->data;

				for (t3 = assertion->AuthnStatement; t3; t3 = g_list_next(t3)) {
					if (LASSO_IS_SAML2_AUTHN_STATEMENT(t3->data)) {
						as = t3->data;
						break;
					}
				}

				if (as == NULL)
					continue;

				if (as->AuthnContext == NULL)
					continue;

				method = as->AuthnContext->AuthnContextClassRef;

				switch (compa) {
				case 1: /* minimum */
					/* XXX: implement 'minimum' comparison */
				case 2: /* better */
					/* XXX: implement 'better' comparison */
				case 3: /* maximum */
					/* XXX: implement 'maximum' comparison */
				case 0: /* exact */
					if (lasso_strisequal(method,class_ref)) {
						matched = TRUE;
					}
					break;
				default: /* never reached */
					break;
				}
				if (matched == TRUE) {
					break;
				}
			}
		}
	} else {
		/* if nothing specific was asked; don't look for any
		 * particular assertions, one is enough
		 */
		matched = (profile->session != NULL && \
				lasso_session_count_assertions(profile->session) > 0);
	}
	if (assertions) {
		lasso_release_list(assertions);
	}
	if (matched == FALSE && request->IsPassive == FALSE)
		return TRUE;
	if (profile->identity == NULL && request->IsPassive) {
		lasso_saml20_profile_set_response_status_responder(LASSO_PROFILE(login),
				LASSO_SAML2_STATUS_CODE_NO_PASSIVE);
		return FALSE;
	}
	return FALSE;
}
lasso_saml20_login_must_authenticate(LassoLogin *login)
{
	LassoSamlp2AuthnRequest *request;
	gboolean matched = TRUE;
	GList *assertions = NULL;
	LassoProfile *profile = &login->parent;

	if (! LASSO_IS_SAMLP2_AUTHN_REQUEST(profile->request))
		return FALSE;

	request = LASSO_SAMLP2_AUTHN_REQUEST(profile->request);
	if (request->ForceAuthn == TRUE && request->IsPassive == FALSE)
		return TRUE;

	if (request->RequestedAuthnContext) {
		char *comparison = request->RequestedAuthnContext->Comparison;
		GList *class_refs = request->RequestedAuthnContext->AuthnContextClassRef;
		char *class_ref;
		GList *t1, *t2;
		int compa = -1;

		if (comparison == NULL || lasso_strisequal(comparison,"exact")) {
			compa = 0;
		} else if (lasso_strisequal(comparison,"minimum")) {
			message(G_LOG_LEVEL_CRITICAL, "'minimum' comparison is not implemented");
			compa = 1;
		} else if (lasso_strisequal(comparison,"better")) {
			message(G_LOG_LEVEL_CRITICAL, "'better' comparison is not implemented");
			compa = 2;
		} else if (lasso_strisequal(comparison,"maximum")) {
			message(G_LOG_LEVEL_CRITICAL, "'maximum' comparison is not implemented");
			compa = 3;
		}

		if (class_refs) {
			matched = FALSE;
		}

		assertions = lasso_session_get_assertions(profile->session, NULL);
		for (t1 = class_refs; t1 && !matched; t1 = g_list_next(t1)) {
			class_ref = t1->data;
			for (t2 = assertions; t2 && !matched; t2 = g_list_next(t2)) {
				LassoSaml2Assertion *assertion;
				LassoSaml2AuthnStatement *as = NULL;
				char *method;
				GList *t3;

				if (LASSO_IS_SAML2_ASSERTION(t2->data) == FALSE) {
					continue;
				}

				assertion = t2->data;

				for (t3 = assertion->AuthnStatement; t3; t3 = g_list_next(t3)) {
					if (LASSO_IS_SAML2_AUTHN_STATEMENT(t3->data)) {
						as = t3->data;
						break;
					}
				}

				if (as == NULL)
					continue;

				if (as->AuthnContext == NULL)
					continue;

				method = as->AuthnContext->AuthnContextClassRef;

				switch (compa) {
				case 1:  
					 
				case 2:  
					 
				case 3:  
					 
				case 0:  
					if (lasso_strisequal(method,class_ref)) {
						matched = TRUE;
					}
					break;
				default:  
					break;
				}
				if (matched == TRUE) {
					break;
				}
			}
		}
	} else {
		 
		matched = (profile->session != NULL && \
				lasso_session_count_assertions(profile->session) > 0);
	}
	if (assertions) {
		lasso_release_list(assertions);
	}
	if (matched == FALSE && request->IsPassive == FALSE)
		return TRUE;
	if (profile->identity == NULL && request->IsPassive) {
		lasso_saml20_profile_set_response_status_responder(LASSO_PROFILE(login),
				LASSO_SAML2_STATUS_CODE_NO_PASSIVE);
		return FALSE;
	}
	return FALSE;
}