Can I access AuthnContextClassRef in a flow decision state?

[Cantor, Scott]

> That was the problem.  I was using idp.authn.flows.initial.   From their pattern
> it looked like they paralleled each other.  Ill advised assumption on my part.

Oh, as in you need both? I'll fix that. No, that's a feature that was trying to compensate for there being no easy to way to do a lookup for attributes in the middle of picking login methods. When it's on, it always runs that set of flows until it gets a username to use, unless a session is already set up. SP request criteria won't affect it.

> The idp.authn.flows.initial line is confusing.  For most entries the commented
> out value is the default.  Not so in this case.   And this one seems to specify
> ordering, which the idp.authn.flows does not.

No, no ordering really, it's the same as the other one, a regular expression.

-- Scott