Hello Chenyang,
Thank you for your feedback. Unfortunately, there is no setting for these flags on the IDP or SP side with the NW SSO release that we have currently. You can set up the authentication contexts with the assignment to the login modules, the default contexts and policies that contain the supported contexts on the IDP side. On the SP side, you can only request authentication context(s) or use the comparison method to request an exact match, better, etc on the IDP side.
I'm going to request an upgrade of our NW SSO server to SP3 because SAP has their own OTP login module in SP3 and they must have faced the same issue when they tried to make it work with SAML 2.0, assuming they have a working 2 level authentication SAML 2.0 set up in SP3.
Regards,
David Barna