IdPv3 CAS Protocol Update

[Tom Zeller]

> The biggest obstacle at present is
> determining how to interact with the Shib authentication flow. I
> imagine it will be a subflow call, and I've modeled as such, but the
> details are unclear.

Reproducing the subflow call for reference :

 <subflow-state id="authenticate" subflow="authn-flow">
    <transition on="success" to="generateTicket" />
  </subflow-state>

> I not only need to call the flow but pass context
> parameters that indicate forced authentication is required under some
> conditions. Any suggestions or recommendations for interacting with
> the authn flow?

Well, it seems like idpv3 should provide an authentication flow as an API.

Something like : flow "auth-flow" returns "success" or "failure" or
"error" if authentication blah blah. And call
IndicatedForcedAuthenticationAction if your protocol needs such a
thing, etc.

Not sure how to make a web flow configuration file an API, though.

By API I mean a defined interface in the smallest sense, not oh hey
let's model authentication generically via web flow, because time.