Authentication Subsystem

[Marvin S. Addison]

> I think it's necessary to have the profile layer do it, yes. That's not
> awkward, IMHO, because the context is the input, or parameters if you
> will, to the subflow that makes up authentication. It's the "caller" that
> supplies the input, so it's the profile handling flow that needs to create
> the context and populate it in part.

Ok, that makes sense. The InitializeAuthenticationContext action led me 
to believe that the pattern is for a flow to initialize the context it 
needs (recall seeing that pattern elsewhere), but I can imagine based on 
your examples that it's probably not the common case. In any case I can 
pretty clearly imagine how the CAS protocol acting at the profile layer 
will hand off the the authentication subsystem, which is good.

Thanks,
M