AuthenticationResult/FlowId for SPSession

[Marvin Addison]

I'm working on a CASSPSession that extends BaseSPSession since that
seems like a natural basis. Unfortunately the authenticationFlowId
field is proving problematic. In the CAS protocol, login and ticket
validation are distinct (in time and location) requests. The SP
session must be added to the IdP session during ticket validation
_after_ the ticket is successfully validated. But by that time, I've
lost the AuthenticationContext carrying the AuthenticationResult I
need that contains the authn flow ID. I have no idea how to tie back
to that and I'm wondering how that works in the SAML case when you're
coming in on an existing SSO session and don't login. Maybe if I
understood that case better I could work out how to wire things up for
my case.

Thanks,
Marvin