add forced authentication support to our authentication flows

templates/etc/shibboleth-idp/conf/authn/general-authn.xml.erb

@@ -26,6 +26,21 @@
     customization, as the examples below for IP address and SPNEGO authentication illustrate.
     -->
 
+    <!--
+        Stanford Note.
+
+        Note that to support ForcedAuthn in AuthRequest's we have to
+        EXPLICITLY turn orced authentication support on for each
+        authentication flow.
+
+        We turn forced authentication support on for these flows:
+          - RemoteUser
+          - TwoStepRemoteUser
+          - RemoteUserInternal
+          - External
+    -->
+
+
     <util:list id="shibboleth.AvailableAuthenticationFlows">
 
         <bean id="authn/IPAddress" parent="shibboleth.AuthenticationFlow"
@@ -52,10 +67,12 @@
         </bean>
 
         <bean id="authn/External" parent="shibboleth.AuthenticationFlow"
-            p:nonBrowserSupported="false" />
+              p:nonBrowserSupported="false"
+              p:forcedAuthenticationSupported="true"/>
 
         <bean id="authn/RemoteUser" parent="shibboleth.AuthenticationFlow"
-              p:nonBrowserSupported="false" />
+              p:nonBrowserSupported="false"
+              p:forcedAuthenticationSupported="true"/>
 
 
         <!--
@@ -70,7 +87,8 @@
         -->
         <bean id="authn/TwoStepRemoteUser"
               parent="shibboleth.AuthenticationFlow"
-              p:nonBrowserSupported="false">
+              p:nonBrowserSupported="false"
+              p:forcedAuthenticationSupported="true">
           <property name="supportedPrincipals">
             <list>
               <bean
@@ -81,7 +99,9 @@
           </property>
         </bean>
 
-        <bean id="authn/RemoteUserInternal" parent="shibboleth.AuthenticationFlow" />
+        <bean id="authn/RemoteUserInternal"
+              parent="shibboleth.AuthenticationFlow"
+              p:forcedAuthenticationSupported="true"/>
 
         <bean id="authn/X509" parent="shibboleth.AuthenticationFlow"
                 p:nonBrowserSupported="false">