Allow RemoteUser Auth method on multiple URLs selected by Auth Context Class

In IDP v2 in handler.xml you can specify multiple URLs for the RemoteUser Auth method and the SP can select by specifying the Auth Context Class. I need this functionality in IDP v3. Our SSO system has an "enhanced" assurance login that asks a personal security question and we need to allow some apps on local SPs to select this. In IDP v2 the SP specifies the "enhanced" Auth Context Class and the user gets redirected to a URL that performs the enhanced SSO login (via apache httpd) and then httpd passes REMOTE_USER (reverse proxy) to the IDP, which retrieves it with the RemoteUser auth method.