extend remoteuser flow?

[Jim Fox]

The remoteuser authn flow redirects to a configured location where,
by external mechanism, the user's id can be obtained from REMOTE_USER.
A simple extension of this flow would allow it to support passive,
forced authn, and maybe token.

In the flow, instead of transferring directly to "ExternalTransfer" (the redirect)
add an action state:

     <action-state id="RemoteUserActionChooser">
       <evaluate expression="opensamlProfileRequestContext.getSubcontext(....AuthenticationContext)).isPassive()" />
       <transition on="yes" to="ExternalTransferPassive" />
       <evaluate expression="opensamlProfileRequestContext.getSubcontext(....AuthenticationContext)).isForceAuthn()" />
       <transition on="yes" to="ExternalTransferForce" />
       <transition on="no" to="ExternalTransfer" />
     </action-state>

Where the two new view-states are similar to ExternalTransfer, but redirect
to the newly configured locations for passive and forced authns.
Assuming that the external authn mechanism supports these.

I think a similar evaluation could provide a token login as well, 
although I haven't tried that yet.

Jim