Allow a specification of supported AuthnContexts.

To configure just set allowedAuthContexts in settings.php
as for example 'security'=>array('allowedAuthContexts'=>
'allowedAuthContexts'=>false; //You don't want a limitation
'allowedAuthContexts'=>array('urn:a', 'urn:b') //Limited to these two

This allows using IWA (Internal Windows Authentication) using AD FS,
because not only forms authentication is supported.
Ensure that the logoutRequest checks against the original Value of the Query String.
This resolves a verification fail using AD FS.

As specified by "Bindings for the OASIS Security Assertion Markup Language V2.0"
http://docs.oasis-open.org/security/saml/v2.0/saml-bindings-2.0-os.pdf

Quote: "Further, note that URL-encoding is not canonical; that is, there are multiple legal encodings for a given
value. The relying party MUST therefore perform the verification step using the original URL-encoded
values it received on the query string. It is not sufficient to re-encode the parameters after they have been
processed by software because the resulting encoding may not match the signer's encoding."