Error in MFA with disallowed AUTHNCONTEXT + requested PasswordProtectedTransport

[Cantor, Scott]

> OK, thanks for the clarification, but what's the solution then?

If an SP asks for something specific, you either let it (and give it what it asks for) or you stop it from asking or you accept that it will fail if it does. The only allowable outcomes to a request like this is "satisfy it or return an error". The blocking feature is just a way to force the second outcome rather than end up doing something you don't want done.

An SP asking for "password" is  probably broken because outside of some very unusual cases, that doesn't make any real sense. So it probably needs to be be fixed.

> If I don't use disallowedFeatures, the ordered list of principals won't be
> enforced.

SAML requires that an SP asking for something get what it asks for. That's not something the IdP can ignore. We don't offer a "not compliant" mode.

-- Scott