Hello
Support for updating this is coming soon (possibly in 16.7!) Once this is rolled out, then you can add the following into the Advanced section of the App;
setAuthnContextClass('urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport');
16.7 is tenantivly scheduled for launch in a few days. You can add this after roll out to see if this corrects the issue you have.
I hope this helps!
Have a great day!
-Ryan V.