Authentication Subsystem

[Marvin S. Addison]

I have been reviewing recent work on the authentication subsystem with 
an eye toward CAS protocol integration and code review prompted some 
observations/questions.

AuthenticationContext has slots for both passive and forced 
authentication, but I don't see where those are set. I imagine that the 
profile handling subsystem is generally the place where the details of 
passive/active are implemented, but the AuthenticationContext isn't 
available yet. By the time the handoff to the authentication flow 
happens, you've potentially lost profile context to make the 
determination. I suppose you could expose some profile-specific context 
data (roughly the approach I took with initial CAS work) that could be 
consumed by the authentication subsystem, but that seems redundant. It 
seems it would be more straightforward to set the passive/forced flags 
on AuthenticationContext at the profile handling layer in a 
profile/protocol dependent fashion. In that case the profile handling 
layer is responsible for initialization of AuthenticationContext, which 
at face value seems awkward. Am I thinking about this clearly? 
Alternative/better approaches?

Thanks,
M