Authentication Method defaulting in SAML1 and SAML2

[Rod Widdowson]

Can I just check my understanding here (probably with Scott).

In the SAML1 "Shibboleth" profile the defaultAuthentications is a
List<AuthenticationMethodPrincipal>, where AuthenticationMethodPrincipal
wraps a java.lang.String; in SAML2 BrowserSSOProfile it is a
List<AuthnContextClassRefPrincipal> where AuthnContextClassRefPrincipal
wraps the SAML2 object AuthnContextClassRef (which in turn wraps a specified
URI).

I'm guessing that this is because the AuthnContextClassRef is a real thing
which may crop up in SAML2 Authentication requests hence the generic SAML2
AuthN flows need to be able to deal with them.  If so my apologies for not
internalizing this earlier.

I am also guessing that the reason that this generically that this is a
List<Principal> and not a Principal is that we may want to try a cascade of
authentication mechanisms if one fails.  So the follow up question is
whether we want to pass this through to the parsing of the
defaultAuthenticationMethod inside <RelyingParty> and allow a series of
space-separated strings to be configured in V3.  Absent someone defining
their own authentication method with a space in its name, this would be a
forward compatible change...

Rod