Problem AuthnContextClassRef with Comparison="exact"

[Cantor, Scott]

> Is there something in the configurations that we may not have configured
> correctly when moving to idp v4? 

No. If you don't want the first method to be "acceptable", don't request it.  SAML defines the full set as an OR, not an AND. If you send >1, then any of them are acceptable, so stopping once one is possible to satisfy is the obvious behavior to implement.

There is a setting that behaves more like V2 did, but it is not advisable and you certainly can't count on that semantic from other IdPs.

-- Scott