MFA with specific authnContextClassRef

[Cantor, Scott]

> The SP is requesting authnContextClassRef of https://refeds.org/profile/mfa
> and the idp errors with "urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext"
> unless I add that classRef to supportedPrincipals of authn/Password, which is
> confusing to me. I didn't think that was needed and I think that would lead to
> mfaCtx.isAcceptable() always returning true?

That's correct, you have something wrong somewhere. Nothing obvious.

-- Scott