Add force_authn sp configuration option

If the value is truthy, "true" is given as the ForceAuthn value. The
value is derived from the 'force_authn' keyword argument as passed to
'create_authn_request()' method otherwise it fallbacks to the
configuration value.

1 files changed, 8 insertions, 0 deletions

diff --git a/src/saml2/client_base.py b/src/saml2/client_base.py
index f740cb07..a5957f1d 100644
--- a/src/saml2/client_base.py
+++ b/src/saml2/client_base.py
@@ -335,6 +335,14 @@ class Base(Entity):
         except KeyError:
             nsprefix = None
 
+        try:
+            force_authn = kwargs['force_authn']
+        except KeyError:
+            force_authn = self.config.getattr('force_authn', 'sp')
+        finally:
+            if force_authn:
+                args['force_authn'] = 'true'
+
         if kwargs:
             _args, extensions = self._filter_args(AuthnRequest(), extensions,
                                                   **kwargs)