MFA authn flow - matching against multiple contexts?

[Cantor, Scott]

> Is your required logic amenable to this:
> 
> mfaCtx =
> authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthe
> nticationContext");
> 
> if (mfaCtx.isAcceptable()) { return null; }  // current principals suffice
> else { return nextFlow; } // run second factor

That is the correct approach. The configuration should be told about what the principals are for each flow, then just ask it to do the correct matching. Anything else will result in eventual SAML non-compliance in any unusual scenarios that happen to be triggered, such as inexact matching in a request.

-- Scott