User-Defined Post Authentication Flows

[Cantor, Scott]

> We have a few of things that we need to do post-authentication that we're
> presently (incorrectly) modeling as intercept flows:
> 
> 1. Expiring password check
> 2. Yearly account checkup

Why do you think incorrectly? My expiring password check is in that hook (it's the one I checked into trunk).

> I've got another one in the pipeline:
> 
> 3. Authentication method check based on 2-factor completion

You shouldn't need that one at all, it would mean the authentication flow(s) themselves need to be fixed. The IdP will cross-check the final result for you, or it probably is a use case for the MFA changes that would provide more control over when the process is "done" or which principals get included.

> #1 could be probably be modeled as a conditions flow, but the other two are
> fairly complex and are best modeled as flows unto themselves. It occurs to
> me that there might reasonably be a standard hook for defining flows that
> run after authentication and can be configured similar to intercept flows.
> Thoughts?

The intercepts are explicitly after authentication, but they cannot *influence* authentication. If you need that, that's really the MFA feature (name aside, it's really more about custom workflows). It isn't necessarily the case that what you're talking about could be assumed to be after any given portion of the authentication process, so I don't think it makes sense to limit the customization to that point.

-- Scott