separating AuthenticationMethod contexts

[Russell Beall]

I am setting up multiple different authentication contexts, and some of these I do not wish to share between SPs.

It seems that when an SP does not request a particular authentication context, the IdP will use an existing one that is active, even if it is not specified as the default for the relying party in the relying-party.xml file.  Additionally, by default, I would expect one of these two AuthenticationMethods to be required when none is specified by the SP and/or no default is in the relying party file:
<ph:AuthenticationMethod>urn:oasis:names:tc:SAML:2.0:ac:classes:unspeci\fied</ph:AuthenticationMethod>        <ph:AuthenticationMethod>urn:oasis:names:tc:SAML:1.0:am:unspecified</ph:AuthenticationMethod>

I have these configured in the default LoginHandler configuration, and these are not listed in the specialized LoginHandler configurations.  The specialized login handlers have only the custom authentication method identifiers that I created myself.

If no LoginHandler has an active session attached, then the correct AuthenticationMethod is selected.

Is this the expected behavior, or is something amiss?

Thanks,
Russ.