Problem AuthnContextClassRef with Comparison="exact"

[Cantor, Scott]

> The anomaly we encounter with idp4 is that only the first in the list is
> considered. With the idp2 it worked exactly as we wanted and as you
> described (in or).

We are talking past each other and I don't know that we can reconcile that, this isn't easy to describe in English.

It examines all the requested methods and compares each one to the set of values it can satisfy with active results (i.e. SSO). If it can't find one, it starts looking at running inactive methods it can run to satisfy them. In each case, it's walking the requested list and stopping at the first time it decides it can handle.

The exception is the MFA flow, which puts most of that decision making in the deployer's hands.

I have no intention of debating or debugging it here, see list footer.

-- Scott