Support MFA (Multifactor Authentication) using the authnContextClassRef="http://id.incommon.org/assurance/mfa" attribute on the SP side (Kibana). This is for Shibboleth, which we are using for federated IdM in the Omnisoc initiative (http://omnisoc.iu.edu). The federation is InCommon, a higher ed federation.

I have used Shibboleth on the SP side in ES 6.1 to do MFA, but it's really just an overlay on ES. There's shibd running, which is the SP, and I can add RequestedAuthnContext there within /etc/shibboleth/shibboleth2.xml as authnContextClassRef="http://id.incommon.org/assurance/mfa" in the <SSO ...> entity.
Should be able to do something similar in the ES SAML implementation.

I do have SAML working in a dev ELK with ES 6.2.2.