Pavel Břoušek · ed05d30e · ed05d30e · ed05d30e · ed05d30e · ed05d30e
--- a/lib/AuthnContextHelper.php
+++ b/lib/AuthnContextHelper.php
           return AuthSwitcher::DEFAULT_REQUESTED_CONTEXTS;
       }
       $supportedRequestedContexts = array_values(array_intersect($requestedContexts, AuthSwitcher::SUPPORTED));
+       if (!$sfaEntropy) {
--- a/lib/Auth/Process/SwitchAuth.php
+++ b/lib/Auth/Process/SwitchAuth.php
               }
           }
       }
-       $result[] = AuthSwitcher::SFA;
+       if (!$this->check_entropy || $this->checkSfaEntropy($state)) {
+           $result[] = AuthSwitcher::SFA;
+       }
--- a/lib/Auth/Process/SwitchAuth.php
+++ b/lib/Auth/Process/SwitchAuth.php
       }
   }

+   private function checkSfaEntropy($attributes)
+   {
+       if (!$this->sfa_len_attr || !$this->sfa_alphabet_attr || !in_array(
+           $this->sfa_alphabet_attr,
+           $attributes,
+           true
+       ) || !in_array($this->sfa_len_attr, $attributes, true)) {
+           return false;