MFA authn flow - matching against multiple contexts?

[Cantor, Scott]

> How /does/ isAcceptable() decide what's acceptable?

It evaluates the Principal objects in the authentication results produced against the Principal objects in the RequestedPrincipalContext using whatever matching operator is in that context.

SAML RequestedAuthnContext rules are translated into a RequestedPrincipalContext before authentication runs, it's a protocol neutral approach.

In the normal case that an exact match is being required, it just looks at the Principals requested and looks for a match in the authentication results that have been produced to that point.

I documented this quite extensively in the wiki.

-- Scott