Accessing SAML request requirements in a MFA transition strategy

[Scott Cantor]

> Unless I'm mistaken, the isAcceptable check doesn't make any difference between those two situations:
> - the SP didn't require any specific auth context, making any current response OK
> - the SP did require a specific context, but the current response already satisfies it

No, it doesn't.

> We want to make the distinction, because we want the IdP to force MFA usage, but only in the first case. Basically, we need to make some of our SPs able to opt-out IdP-enforced MFA usage, instead of the usual opt-in scenario... Don't blame me, I'm innocent for this decision :)

Just check whether a RequestedPrincipalContext exists underneath at all and dispatch based on that. If there isn't one, you need not "test" anything because you're fully in control of the options. You only have to call the method if it's present.

-- Scott