can an application behind the SP get at the AuthnClass?

[Jerry Shipman]

Hello,
I have an application behind a Shib SP on apache (trying to migrate it from a different web SSO system). Is there a way for me to find out which AuthnContextClassRef the user used to log in? The application currently gets this out of our old system basically in order to log whether it was a 1F or 2F session, which later feeds into some risk assessment decision. I can see how to map "attributes" to environment variables, but I haven't yet figured out how to get at the AuthnContextClassRef.  Can somebody point me in the right direction?

Thank you,
Jerry
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210422/a1e804b4/attachment.htm>