Multiple authentication levels for a single application

[Cantor, Scott]

> Either I need a way for the SP to issue two different kind of login requests, each using a different content in
> <samlp:RequestedAuthnContext> element, so as to have a single IdP select the correct authentication flow
> accordingly. I guess using different session initiators handlers, at different URLS, would be enough, but then I'll need
> different authentication links/buttons in the application ( "login as user", and "login as admin").

The redirection protocol for passively initiating sessions in the SP has parameters for setting the context class, so you don't need anything but some code, and you need code in the application to do anything like this no matter what.

-- Scott