Shib IdP 3.3 MFA - AuthnContextClassRef issue

[Cantor, Scott]

> I've been working on updating the shib-mfa-u2f-auth plugin to fully support
> IdP v3.3 and the MFA flow. The plugin works but with one little exception, I
> can't get the MFA flow to send the correct AuthnContextClassRef back in the
> SAML response. Not even when the SP requests the specific one that I'd
> expect.

Maybe you posted the wrong log, but the one you posted shows an SP requesting the PPT context, so unsurprisingly that's what gets returned.

In the general case that both factors are performed and the SP requests nothing, it's nominally undefined what it will return because any of them are "valid", but you can control it for most purposes by adjusting entries in the PrincipalWeightMap bean to give them relative importance to each other.

-- Scott