The IdPAuthPreviousSession login handler [1] reports a previous authentication method by default. According to section 3.4.10 of the Authn Context spec, the IdPAuthPreviousSession authn context class should be reported instead, or at least that's my interpretation. Thoughts? Tom [1] https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthPreviousSession