How to access the AssertionConsumerServiceURL from the AuthnRequest in a custom MFA flow

[Peter Schober]

* Marc Jay <marc.jay at taskize.com> [2020-04-16 18:24]:
> We have an existing Shibboleth SP and IdP setup with IdP 3.4.6 and
> an MFA flow that programmatically selects flows depending on the
> user’s access and whether they should be “SP-initiated” SSO
> redirected to a user’s company’s IdP for auth. This decision needs
> the user’s email address and some database calls to determine the
> answer, and we don’t want to make the user pick from a list of IdPs

I'm not following... You're running a SAML proxy (otherwise why would
your IDP config be relevant to IDP selection?) and your IDP is the only
one known to the protected services and in turn (as a SAML SP) relies
on upstream IDPs for the actual authentication?

How can you determine the IDP the subject should be sent to based on
the subject's email address if the subject hasn't authenticated at an
IDP to assert that email address to you in the first place?

-peter