requiring MFA for an unsolicited SSO SP

[Cantor, Scott]

> > Orthogonal to the use case at hand, but does the same apply to
> forceAuthn?
> 
> There has never been a feature to control ForceAuthn. Nor has anybody
> ever requested it to my knowledge.

It occurs to me though that the best way to deal with this is probably to make the setting a predicate that just evaluates the AuthnRequest and says yes/no, which could be done with an inbound interceptor too, I'd have to see if that's exposed enough at this point. Either way, a generic check is better, in which case you can block requests with whatever you want in them and we don't have to build a million flags in.

-- Scott