Accessing different locations of the same SP

[SAMUELE RILLI]

Hi,
I set up a Shibboleth IdP 3.2.1 and a Shibboleth SP 2.5.4.
The SP is configured to protect some locations, such as:
https://sp.url/level1
https://sp.url/level2

Each location is bound to a different custom authnContextClass: level1
requires user-pwd, level2 requires user-pwd and OTP.
Now, the authentication works on both locations, but once I'm authenticated
to a level I can access any level in that SP. Instead, in my scenario, I am
not supposed to access an higher level of authnContextClass: when
authenticated to level1 I must re-authenticate in order to access level2.
Is it possible to force this kind of behavior?

I have already created a flow for each custom level in
shibboleth-idp/flows/authn, I configured such flows in
shibboleth-idp/conf/authn/general-authn.xml, and finally I defined levels
hierarchy with the bean "shibboleth.MinimumClassRefMatchFactory" in
shibboleth-idp/conf/authn/authn-comparison.xml.

Thanks in advance
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160901/2e91c879/attachment-0001.html>