Configuring Duo authentication for use upon request

...

The SessionInitiator is extremely configurable and can allow for many customizations and different ways of using it.  In the latest releases, this element is not configured by default and the software automatically configures it to the defaults.  The following line can be added to the Sessions element, or it can be used inside of another SessionInitiator of type="Chaining" if you have multiple ways to initiate a session.  In any case, the key attribute is authnContextClassRef.  This attribute is configured on the SessionInitiator of type SAML2.  For example:

...