forced Authentication with authn/External

[Cantor, Scott]

> I would love to either override this in relying-party.xml for one SP, but that did not seem to
> work

The problem is not making ForceAuthn happen, that's all that setting does. The SP is already doing it, and no, you can't set it to false in the config to override what the SP says, that would be a serious violation.

The issue is:

- Does the flow support it at all? That's purely a global consideration and is not a per-RP question.
- Can SPs request it?

The latter is controllable with the relying-party features, via the disallowedFeatures property. That was extended in 5 to allow blocking FORCE_AUTHN in requests and could be applied at the default level if desired and then permitted as a one-off via override.

-- Scott