Mixed one/two-factor authentication environment

[Tanja Sialevri <tanja.sialevri@gmail.com>]

I'm working on a federation scenario where some services require only password authentication and some two-factor authentication (hard token).

I was thinking of starting of with an Authentication Context that requires only password and when the user requires a service that needs two-factor auth, I'd log him out and request that he logins again in an Authentication Context that requires the use of his hard token.

Is this the way to go in a mixed one/two-factor authentication enviroment?