AuthnContext Equivalency

[Cantor, Scott]

> We're going to be forced to use multiple AuthnContext strings to indicate
> use of a second factor.  These will be conceptually identical, so I would like
> authentication with either context to result in SSO for the other, but I want
> to echo back the requested context.
> 
> Do I need to play with the AuthnContext comparators, or is it sufficient to
> make sure the Principals used will satisfy the request, or is there some better
> way to do all this with the MFA scripting?

I believe it should work fine if you just enumerate them all as supported by your flow, but it's possible you might run into an issue with it deciding to return the wrong one in the assertion, depending on how you're expecting that to work. If you request a specific one, it should do the right thing, but if you don't, it will pick one to use, though you can control which one using a weighting trick in the config.

-- Scott