Can I access AuthnContextClassRef in a flow decision state?

[Cantor, Scott]

>This in idp.properties
>
>   # RemoteUserInternal handles ECP only
>   idp.authn.flows= remoteuserplus|remoteusertoken|RemoteUserInternal

And you are *not* using idp.authn.initial? Or whatever it's called...if you are then all bets are off, and I'm sure there's some interaction here I don't understand and probably didn't intend.

>2016-06-15 15:25:29,874 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:257] - Profile Action SelectAuthenticationFlow: No specific Principals requested

That line there means the request from the SP did *not* contain a RequestedAuthnContext element, and there was nothing configured in relying-party.xml to dictate what method to use.

Or it means you're using that initial-authn feature. So I'm guessing you are.

If you're building you own custom flow(s), avoid that feature like the plague. You don't need it.

>2016-06-15 15:25:40,493 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeAuthenticationContext:115] - Profile Action InitializeAuthenticationContext: Created authentication context: AuthenticationContext{initiationInstant=2016-06-15T15:25:40.493-07:00, isPassive=false, forceAuthn=false, hintedName=null, potentialFlows=[], activeResults=[], attemptedFlow=null, signaledFlowId=null, authenticationStateMap={}, resultCacheable=true, initialAuthenticationResult=AuthenticationResult{authenticationFlowId=authn/remoteuserplus, authenticatedPrincipal=fox, authenticationInstant=2016-06-15T15:25:40.476-07:00, lastActivityInstant=2016-06-15T15:25:40.476-07:00}, authenticationResult=null, completionInstant=1969-12-31T16:00:00.000-08:00}

That makes me fairly suspicious you're using that feature.

-- Scott