Controlling post-authn flow activation

[Cantor, Scott]

Just a thought...

Since these initial flows are all post-authn processing, should we put
information into the AuthenticationProfileConfiguration interface (the one
the SSO profile configs and CAS's will inherit from) to control which
one(s) to run?

This would be either alternative to or in addition to the activation
condition on the flow descriptors.

I'm just thinking it might eliminate redundancy in creating conditions
classifying relying parties if it could be done in relying-party.xml.

An option would be to inject the list of ProfileInterceptorFlowDescriptors
to activate for a given profile configuration, and use that derive the set
to enable. Could also be intersected with the property that's currently
controlling that.

-- Scott