Can Shib IDP include multiple AuthnContextClassRef elements in the SAML response?

[Joey Wang]

 Hi, 
I am working on a requirement supporting a MFA case using Shibboleth IDP where the relying party wants IDP to include all the authentication methods in the multiple AuthnContextClassRef elements such as:
</saml2:AuthnStatement>    </saml2:AuthnContext>>    <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef><saml2:AuthnContext><saml2:AuthnStatement AuthnInstant="2014-06-10T12:32:29.263Z">
</saml2:AuthnStatement></saml2:AuthnContext>><saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken</saml2:AuthnContextClassRef><saml2:AuthnContext><saml2:AuthnStatement AuthnInstant="2014-06-10T12:32:29.263Z">
I have built an authn flow extension in IDP 3.2.1 to put multiple principals into the subject object of the AuthenticationResult. But in the end, only one of the principals is returned in the response. Looking at the document for RequestedPrincipalContext, it says "After successful authentication, this context also contains a custom Principal produced by the authentication process that actually matched the specified requirements. In SAML terms, this is what will end up in the assertion's AuthnContext element". Looking at the RequestedPrincipalContext class, it allows to set only one matching principal even if there are multiple requested principals in the RequestedPrincipalContext object. 
So my question is that is there a hook that I can extend IDP to allow multiple principals to be included as AuthnContextClassRef in the Saml response?
Thanks a lot.
Joey
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160205/1080f510/attachment-0001.html>