Switching authnContextClassRefs on SP

[Cantor, Scott]

> I'm observing the following SP behaviour: first I access /secure/ and
> get a session with authnContextClassRef "PasswordProtectedTransport",
> then I access /secure-mfa/ and the SP throws a 401 unauthorized error.
> Is this the expected behaviour?

Yes. The SP has no facility for "step-up", that's an application issue to deal with. The only work around is to fork the content into separate applications in the SP to force separate sessions to be setup with the IdP.

> I would prefer the SP to send another authnRequest asking for my
> authnContextClassRef. Is there a way to do that (beside trapping the 401
> in the web application and handling it there)?

That is the assumption (not trapping the 401, literally enforcing the requirement and responding as intended).

-- Scott