authnContextClassRef for a specific url

[Peter Schober]

* Idar Borlaug <idar.borlaug at gmail.com> [2015-06-01 10:48]:
> I have full control over the page returned if the wrong login is used, i
> check the attributes in my application.
> 
> Would a javascript redirect to logout url with redirect to the same page be
> a good solution?
> 403 page -> redirect to shibboleth.logout?url= same url

I don't see how your JavaScript code would have access to the fact
that the requested authnContextClass was not in the SAML respons, but
that's your problem if you want to make this into a browser scripting
issue.
More importantly this would only change the second ("future") part of
your issue, not the one you asked about: Anyone coming to the
protected resource with a valid session for that Shib SP and path
(e.g. from accessing other content first, or from IDP-initated SSO)
would not run into a HTTP 403.
-peter