Backend

See the bottom of the first box on this Shibboleth Wiki page:

https://wiki.shibboleth.net/confluence/display/IDP30/ProfileConfiguration-Authentication

So the new override is called 'forceAuthn", it is Boolean valued with the default value being 'false'. So it would be treated just like, for example, the signAssertions setting, which is also boolean with a default value of false..

For the backend, the entity attribute name would be (for the protocol neutral override, which is what we are doing with all the overrides):

  http://shibboleth.net/ns/profiles/forceAuthn