fix: correct no tokens redirect

lib/Auth/Process/SwitchAuth.php

@@ -136,26 +136,6 @@ class SwitchAuth extends \SimpleSAML\Auth\ProcessingFilter
 
         $upstreamContext = $this->proxyMode ? ProxyHelper::fetchContextFromUpstreamIdp($state) : null;
 
-        if (
-            ($mfaEnforced ||
-            (
-                $this->authnContextHelper->MFAin($state['saml:RequestedAuthnContext']['AuthnContextClassRef'] ?? []) &&
-                !$this->authnContextHelper->SFAin($state['saml:RequestedAuthnContext']['AuthnContextClassRef'] ?? []) &&
-                !($this->proxyMode &&
-                $upstreamContext &&
-                $this->authnContextHelper->MFAin([$upstreamContext]))
-            )) &&
-            empty($state['Attributes'][AuthSwitcher::MFA_TOKENS]) &&
-            !in_array($this->entityID, $this->mfa_excluded_sps) &&
-            !empty($this->setup_mfa_redirect_url)
-        ) {
-            self::info('user must perform MFA but has no tokens, redirect to setup');
-            $url = Module::getModuleURL(self::SETUP_MFA_URL);
-            $state[self::PARAM_MFA_REDIRECT_URL] = $this->setup_mfa_redirect_url;
-            $stateId = State::saveState($state, 'authswitcher:authswitcher');
-            HTTP::redirectTrustedURL($url, ['stateId' => $stateId]);
-        }
-
         self::info('user capabilities: ' . json_encode($usersCapabilities));
 
         self::setErrorHandling($state);
@@ -169,15 +149,18 @@ class SwitchAuth extends \SimpleSAML\Auth\ProcessingFilter
             $usersCapabilities,
             $state,
             $upstreamContext,
-            !$this->check_entropy || $this->checkSfaEntropy($state['Attributes']),
-            $mfaEnforced
+            !$this->check_entropy || $this->checkSfaEntropy($state['Attributes'])
         );
 
         self::info('supported requested contexts: ' . json_encode($this->supported_requested_contexts));
 
         $shouldPerformMFA = !$this->authnContextHelper->MFAin([
                 $upstreamContext,
-            ]) && ($mfaEnforced || $this->authnContextHelper->isMFAprefered($this->supported_requested_contexts));
+            ]) && (
+                $mfaEnforced
+                || empty($this->supported_requested_contexts)
+                || $this->authnContextHelper->isMFAprefered($this->supported_requested_contexts)
+            );
 
         if (
             $this->mfa_preferred_privacyidea_fail
@@ -187,6 +170,26 @@ class SwitchAuth extends \SimpleSAML\Auth\ProcessingFilter
             throw new Exception(self::DEBUG_PREFIX . 'MFA should be performed but connection to privacyidea failed.');
         }
 
+        if (
+            $shouldPerformMFA
+            && empty($state['Attributes'][AuthSwitcher::MFA_TOKENS])
+            && !empty($this->setup_mfa_redirect_url)
+            && !in_array($this->entityID, $this->mfa_excluded_sps)
+        ) {
+            self::info('user must perform MFA but has no tokens, redirect to setup');
+            $url = Module::getModuleURL(self::SETUP_MFA_URL);
+            $state[self::PARAM_MFA_REDIRECT_URL] = $this->setup_mfa_redirect_url;
+            $stateId = State::saveState($state, 'authswitcher:authswitcher');
+            HTTP::redirectTrustedURL($url, ['stateId' => $stateId]);
+            exit;
+        }
+        if (empty($this->supported_requested_contexts)) {
+            Logger::info(
+                'authswitcher: no requested AuthnContext can be fulfilled: ' . json_encode($requestedContexts)
+            );
+            self::noAuthnContextResponder($state);
+        }
+
         // switch to MFA if enforced or preferred but not already done if we handle the proxy mode
         $performMFA = $this->authnContextHelper->MFAin($usersCapabilities) && $shouldPerformMFA;