some comments about v3 post-login / post-authn flows

[Marvin Addison]

> I wired in the master post-authn subflow into the abstract SSO flow
> after attribute resolution :
>
> <subflow-state id="DoAttrCheck" subflow="access/attr-check">
>    <input name="calledAsSubflow" value="true" />
>    <transition on="proceed" to="DoPostAuthnSubflow" />
> </subflow-state>
>
>  <subflow-state id="DoPostAuthnSubflow" subflow="post-authn">
>     <input name="calledAsSubflow" value="true" />
>     <transition on="proceed" to="BuildResponse" />
> </subflow-state>
>
> and was thinking that this could also be wired into the CAS
> abstractValidate flow during the resolveAttributes action-state, but
> before evaluating extractAttributes.

Just to clarify, is attribute resolution a required precondition of
the post-authentication flows? I would think so since the consent
feature is one of the candidate flows and it deals with attributes.

In any case I think your proposal for flow logic in the CAS protocol
makes sense.

M