IdP: How to configure UserAuthentication with custom AuthnContextClassRef

[Rainer Hoerbe]

I would like to set AuthnContextClassRef to some identity assurance level, like AL2 for the UsernamePassword LoginHandler, and AL3or X.509, depending on the certificate type. 
Q:
- Is there a configuration option in the IdP to rewrite the AuthnContextClassRef depending on the LoginHandler?
- How would I implement a more complex policy? Like AL3 or AL4 depending on the certificate's CA; AL1 or AL2 depending on some user attributes.

- Rainer Hörbe
Stadt Wien, Austria