User-Defined Post Authentication Flows

[Marvin Addison]

We have a few of things that we need to do post-authentication that we're
presently (incorrectly) modeling as intercept flows:

1. Expiring password check
2. Yearly account checkup

I've got another one in the pipeline:

3. Authentication method check based on 2-factor completion

#1 could be probably be modeled as a conditions flow, but the other two are
fairly complex and are best modeled as flows unto themselves. It occurs to
me that there might reasonably be a standard hook for defining flows that
run after authentication and can be configured similar to intercept flows.
Thoughts?

I considered using a custom c14n flow since to do #3 since squinting it
seems like "subject oriented" work, but a general post-authn hook could be
more generally useful for all cases above.

M
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160801/03c94f00/attachment.html>