Enforce re-authenticate user

[Raadush]

Hi,
I have this problem. I have built custom authentication engine which has
several means of authentication (you can use username/password, sms, nfc).
When user is already authenticated I want to check what method he used and
if he didnt use strong enough authentication for selected sp I want to
force him to reauthenticate. Example:

Lets say we have SP1 and SP2. It doesn't matter for SP1 what method user
used, if he comes through SP2, he should authenticate only using mobile
phone. Now it works like this

user accesses SP1 -> he is redirected to my IDP -> authenticates using
password -> SP1 accepts it
user accesses SP2 -> he is redirecred to my IDP -> IDP authenticates him
based on previous session -> SP2 accepts it

I want to change it to something like this:

user accesses SP1 -> he is redirected to my IDP -> authenticates using
password -> SP1 accepts it
user accesses SP2 -> he is redirecred to my IDP -> IDP checks if he used
strong enough method when he authenticated himself at SP1 -> if he USED
strong enough method, IDP authenticates him based on previous session like
before, if he DIDNT used strong enough method, he is forced to
re-authenticate

How can I achieve something like this?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140217/7cb47387/attachment-0001.html