step-up authentication

[Tom Scavo]

I'm writing a profile for step-up authentication where an SP sends the
following AuthnRequest to the IdP:

<samlp:AuthnRequest ...>
 <saml:Issuer>https://sp.example.com/SAML2</saml:Issuer>
 <saml:Subject>
   <saml:NameID Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress">
     user at example.org
   </saml:NameID>
 </saml:Subject>
 <samlp:NameIDPolicy AllowCreate="false"/>
 <samlp:RequestedAuthnContext>
   <saml:AuthnContextClassRef>
     http://example.org/authncontextclass/duo-mobile
   </saml:AuthnContextClassRef>
 </samlp:RequestedAuthnContext>
</samlp:AuthnRequest>

As a result, the IdP prompts the user for a one-time passcode (OTP).
The user generates an OTP on their mobile device and enters it at the
prompt. The IdP validates the OTP using the email address in the
AuthnRequest (which was previously bound to the mobile device).

My question is: Can a Shib SP issue such an AuthnRequest? Asked
another way, can the SP somehow map an incoming request to an email
address and then issue the AuthnRequest shown above?

Thanks,

Tom