AuthnContextClassRef from SSP SP seeming to be ignored

[Wessel, Keith]

Hi, all,

Looking for thoughts on how to best debug this or atheory of what I might be doing wrong.

I've got a SimpleSAMLphp SP that will be part of a proxy IdP setup. I'd like it to request our MFA context. It works fine with password authentication, but when I add:
'saml:AuthnContextClassRef' => 'urn:mace:incommon:uiuc.edu:custom'
(No, that's not really the context class ref I'm using; figured the realone didn't need to be posted here)
to the SP configuration, I still get through with just password. Requesting the same context from a Shib SP results in me being prompted for MFA.

The SP is definitely including the context class ref in the request. Here's the tail end of the request from the SSP logs:

2017-01-11T13:25:20.576794-06:00 grady-test1 simplesamlphp[7357]: 7 [12cd40567d]   <samlp:RequestedAuthnContext>
2017-01-11T13:25:20.576833-06:00 grady-test1 simplesamlphp[7357]: 7 [12cd40567d]     <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:mace:incommon:uiuc.edu:custom</saml:AuthnContextClassRef>
2017-01-11T13:25:20.576872-06:00 grady-test1 simplesamlphp[7357]: 7 [12cd40567d]   </samlp:RequestedAuthnContext>
2017-01-11T13:25:20.576910-06:00 grady-test1 simplesamlphp[7357]: 7 [12cd40567d] </samlp:AuthnRequest>

The audit log from the IdP tells me that the authn context class in the response is, in fact, password and not MFA. I wouldn't expect anything different.

What would be a good starting point for debugging this? What might I turn up logging for first? Or does anyone know of anything about the way that SSP passes such requests through that would cause it not to work with Shib?

Thanks,
Keith