AuthenticationContext with MFA

[Andrew Morgan]

When I authenticate for an SP that requests the MFA 
authenticationContextClassRef (forced in relying-party.xml to be 
"http://id.incommon.org/assurance/mfa"), the audit log shows 
"http://id.incommon.org/assurance/mfa" was used:

2017-08-10 11:02:06,248 - INFO [Shibboleth-Audit.SSO:241] - 20170810T180206Z|10.214.121.42|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_0ad10c981ef02740261eeac2731e554bdaeb2dccbe|http://people.oregonstate.edu/~morgan/simplesaml/module.php/saml/sp/metadata.php/default-sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://login.oregonstate.edu/idp-dev/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_76bdd474fad646b9664b4a3a830a7a96|morgan|https://refeds.org/profile/mfa|commonName,eduPersonPrimaryAffiliation,osuprimarymail,eduPersonScopedAffiliation,eduPersonAffiliation,surname,givenName,eduPersonPrincipalName|AAlzZWNyZXQ2MDcDXvGktyQO74aIBVX5gmXuSIweAaDMxgro5cznnLrXGxLy9/lQeSFKqDpVksO/3q8pCqie5fnXY+CmDkmonPKlX6aH+hW9S1rM0sVVAVT6l3pnLrAgHxams7NiByE3VBthg5bBj14x/HUcsOZVleI5fSMiQs2Y2rf4rq9ikazrkrGNih+nbBNmPmZhmOlv|_dd70f6b5d425b813b71cb7daa924e848|


If I authenticate for an SP that does not require MFA, but my MFA 
transition logic requires MFA for that particular user (in this case, via 
a test of group membership), the audit log says that 
"urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" was 
used:

2017-08-10 11:07:55,888 - INFO [Shibboleth-Audit.SSO:241] - 20170810T180755Z|10.214.121.42|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_5316d75a-4567-403c-84b9-3271e208c8b6|https://account-d.docusign.com/organizations/0284fa80-8b6c-4bcf-b411-e997a4d705e9/saml2|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://login.oregonstate.edu/idp-dev/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_210c7a97d514433f9455cd4b97401082|morgan|urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|commonName,eduPersonPrimaryAffiliation,docusign-principal,osuprimarymail,eduPersonScopedAffiliation,eduPersonAffiliation,surname,givenName,eduPersonPrincipalName|<redacted>|_cc835e52089014fdab999b4dda98c431|

Why doesn't it return the "http://id.incommon.org/assurance/mfa" 
authContext in this case?

Thanks,
 	Andy