Scripted AuthnContextClass/AuthenticationPrincipalWeightMap

[Cantor, Scott]

> We try to connect several SPs that are not able to request a correct AuthnContextClass
> for MFA. They (sadly) require a non standard ContextClass for transfering this setting.

There aren't any important "standard" contexts, they're all arbitrary or community-specific, but...

Either the SP is asking for it, in which case that's what will be returned (or it fails), or you can apply that on the IdP side as a requirement via defaultAuthenticationMethods (via RP override or metadata tag), in which case the same thing happens, that's what will be returned.

There is no use of the weight map here, it's irrelevant to the problem.

The weight map only applies to cases where no requirement exists, and the IdP has to pick one from the full set the Subject contains.

Another way to say it...if you were to script something like this, the script has to have a basis to run and decide, and if that decision is based on who the SPs are, then that's simply the criteria needed to apply a tag or override to get defaultAuthenticationMethods set properly for those SPs.

-- Scott