Can Shib IDP include multiple AuthnContextClassRef elements in the SAML response?

[Cantor, Scott]

> Are you saying Shib 3.2.x currently does
> not support this option and there is no way we can extend it (without
> modifying the core of Shib IDP) to support this option?

I'm saying that SAML does not permit a single AuthnStatement to have multiple AuthnContextClassRefs.

In theory you can issue multiple AuthnStatements or multiple assertions, but that is indeed not supported.

-- Scott