Multiple authentication levels for a single application

[Cantor, Scott]

> In this scenario, with multiple potential results for a given flow, is 
> there any need for the SP to express a requirement in its authentication 
> request (as one or multiple authnContextClassRef values), or is it 
> useless, as the IdP only know about a single flow anyway ?

If you're talking about a Shibboleth IdP, flows are an internal issue. SPs don't request flows, they request context classes that are mapped into custom principal objects that are associated with flows (and often objects inside the flows) in an NxN relationship that is also entirely internal to the IdP.

-- Scott