Checking AuthnRequest for the presence of attributes

[Cantor, Scott]

> For example, our regulation says that the element Issuer must include the
> attributes Format and NameQualifier;

That would be wrong. The Issuer element should never contain NameQualifier for the SSO profile, and while it could contain Format, the value would have to be a particular value and so is generally never set. Requiring that both be set would be incorrect. Not just a bad idea, literally incorrect.
 
> or, for some custom AuthnContextClassRef, I need to check that ForceAuthn is set to 1.

That would also be incorrect. AuthnContexts are orthogonal to ForceAuthn.

These are not appropriate SAML requirements.

-- Scott