AW: RemoteUser authnMethodHeader example?

[ERLER Peter]

> If your flow supports a custom AuthnContextClassPrincipal called "urn:foo" then put urn:foo in the header and it will include that in the Subject. That's pretty much it.

> Normal example would be when the external flow supports Password and Duo, and you need to signal back which one was used. The flow has to support both so it's triggered correctly, but you turn off the auto-add of > the supported principals (which would include both) and drive the result with the header (so it includes only the right one(s)).

We use ExternalAuth. 
In IDP V2 we set the Request-Attribute *ExternalAuthentication.AUTHN_METHOD_PARAM* to adapt AuthnContextClass to the result of the external flow.
In IDP V3.3 the Request-Attribute *ExternalAuthentication.AUTHN_METHOD_PARAM* is deprecated and it doesn't work. 
So we extended the AuthenticationFlowDescriptor to inject the correct external AuthnContextClassRefPrincipal.

Peter Erler