Problem AuthnContextClassRef with Comparison="exact"

[Cantor, Scott]

You should also bear in mind the property idp.authn.External.addDefaultPrincipals is true by default.

What that means, as is documented, is that any "supported" Principal in the configuration of the External login flow will be automatically attached to the Subject created by the flow, which means that SSO will work for any requests that carry any of those context classes.

If your Exernal flow is programatically controlling which AuthnContext class to include, then by definition you also have to turn the property off, which is also documented, or you will get unexpected behavior.

-- Scott