I want to force reauthentication when a user signs a document using
AuthnContextClassRef (to bypass browser caching authentication) in the SAML request. Is it a good idea to save the authentication context class from the SAML response when the user logs in, and later, when the user needs to sign, specify the saved class as
AuthnContextClassRef in the SAML request?
The idea is that the user will need to use the same authentication method for signing the document as when logging in. And there would be no need to configure the authentication context in the SP (with the risk of configuring something that the IdP doesn't support).