different AuthnContextClassRef for different discovered IDP

[Peter Schober]

* marangiom <m.marangio at innova.puglia.it> [2016-06-08 09:54]:
> Is it possible configure my SP to override AuthnContextClassRef and
> set it to Z for every service only when the IDP D is selected via
> discovery?

I don't think there's a setting anywhere to the effect of "if you send
an(y) authn request to IDP D then always include a request for
AuthnContextClassRef Z, too". Neither in the SP nor in the CDS.

I doubt there's a metadata extension to address that case either.

If you really only had 4 IDPs you could simply forgo use of an
external IDP Discovery Service (which is overkill, IMO, and the Shib
CDS is going away soon anyway) and simply hand-craft the
session-initiating links into your SP(s) or application(s), each time
including the "correct" auth context for each IDP.

-peter