IdPv3 CAS Protocol Update

[Marvin Addison]

> Well, it seems like idpv3 should provide an authentication flow as an API.
>
> Something like : flow "auth-flow" returns "success" or "failure" or
> "error" if authentication blah blah. And call
> IndicatedForcedAuthenticationAction if your protocol needs such a
> thing, etc.

That would be very helpful for authn, and generally for all flows that
might be invoked outside their natural context. In order to accomplish
a complete API description, there's a decision point (maybe the same
or related to what Scott already mentioned about baseline metadata)
about what capabilities are generic versus protocol specific. I can
imagine that forced authn would be a generic capability, but there may
be other candidates that are harder to determine.

M