Drafty work on authentication subcontexts

[Marvin S. Addison]

> https://wiki.shibboleth.net/confluence/display/IDP30/Authentication+and+Ses
> sion+Management

"Identifiers and Profile Subcontexts" section looks good. I was curious 
about the use case for "hintedName;" wasn't self-evident to me.

I can imagine that it might be helpful to know what component 
authenticated a particular subject; for example, AuthenticationContext 
could store Map<Subject,AuthenticationHandler> to associate them. More 
generally, there may be arbitrary metadata to associate with 
authenticated subjects. (The identity assurance use case comes to mind.) 
Have you given thought to that sort of capability?

> So I was thinking an authn workflow could produce a Subject.
> I'm not any kind of big fan of that API, but it seems weird to build a
> whole new way of wrapping identifiers and arbitrary credentials.

Agree strongly on that point. The exception hierarchy is also fairly 
expressive, and it's baked into so many other related APIs (e.g. JAAS, 
cert handling) that you'd have to do a fair bit of work to avoid it.

M