anchor.diff:  If the SAML realm is configured accordingly and the IdP supports it (see <<saml-logout>>), this request will trigger a SAML
   SP-initiated Single Logout. In this case, the response will include a `redirect`
   parameter indicating where the user needs to be redirected at the IdP in order to complete the logout.
  -. Alternatively, the IdP might initiate the Single Logout flow at some point. In order to handle this, 
  +. Alternatively, the IdP might initiate the Single Logout flow at some point. In order to handle this,
   the Logout URL (`sp.logout`) needs to be handled by the custom web app. The query part of the URL that the
   user will be redirected to will contain a SAML Logout request and this query part needs to be relayed to {es}
  -using the <<security-api-saml-invalidate,SAML invalidate API>> 
  +using the <<security-api-saml-invalidate,SAML invalidate API>>
   +
   [source,console]
   --------------------------------------------------
  
positive.code: the corresponding authentication response. The restrictions might have to do
  with the authentication method (password, client certificates, etc), the
  user identification method during registration, and other details. {es} implements
  https://docs.oasis-open.org/security/saml/v2.0/saml-authn-context-2.0-os.pdf[SAML 2.0 Authentication Context], which can be used for this purpose as defined in SAML 2.0 Core 
  Specification.
  
  In short, the SAML SP defines a set of Authentication Context Class Reference
  values, which describe the restrictions to be imposed on the IdP, and sends these
  in the Authentication Request. The IdP attempts to grant these restrictions. 
  If it cannot grant them, the authentication attempt fails. If the user is 
  successfully authenticated, the Authentication Statement of the SAML Response 
  contains an indication of the restrictions that were satisfied.
  
  You can define the Authentication Context Class Reference values by using the `req_authn_context_class_ref` option in the SAML realm configuration. See 
  <<ref-saml-settings>>. 
  
  {es} supports only the `exact` comparison method for the Authentication Context. 
  When it receives the Authentication Response from the IdP, {es} examines the 
  value of the Authentication Context Class Reference that is part of the
  Authentication Statement of the SAML Assertion. If it matches one of the 
  requested values, the authentication is considered successful. Otherwise, the 
  authentication attempt fails.
  
  [[saml-logout]]
  
negative.code: +
  The custom web application will then need to also handle the response, which will include a `redirect`
  parameter with a URL in the IdP that contains the SAML Logout response. The application should redirect the user
  there to complete the logout.
  