AuthnContextRef vs. AuthnContextDeclRef?

[John Dennis]

[This question perhaps belongs on the OAIS saml-dev list but I figure 
folks here probably have a good insight, including Scott]

I've read the relevant sections of the SAML Core spec and the SAML 
Authentication Context spec but I can't seem to draw the distinction 
between the use of AuthnContextRef and AuthnContextDeclRef in either a 
AuthnReqest or as returned in an assertion.

The only thing I could intuit was AuthnContextRef is meant to be used 
with the predefined classes in the Authentication Context spec and the 
AuthnContextDeclRef is for privately defined classes (because they have 
to be declared someplace, e.g. by following the URL ref or "inline" via 
AuthnContextDecl).

Can somebody clarify AuthnContextRef vs. AuthnContextDeclRef?

If an IdP receives an AuthnContextDeclRef or AuthnContextDecl in a 
AuthnRequest is it required to parse the declaration and confirm it 
satisfies the conditions before returning it in the assertion?

I've got an SP that sends two AuthnContextRef's in the AuthnRequest, one 
is predefined the other is unknown to me. The IdP returns the known 
context class inside a AuthnContextRef element and the unknown class 
inside a AuthnContextDeclRef. This confuses the SP as it is expecting 
both to be returned in an AuthnContextRef. I'm trying to figure out what 
the defined behavior is supposed to be.

Thanks,

-- 
John