User-Defined Post Authentication Flows

[Cantor, Scott]

> Yeah, I've come to that conclusion on my own and we've decided to refactor
> based on the recent MFA support you've developed. That's the only sane
> and supportable way forward afaict.

In case it's non-obvious, the best place for most subject manipulation will usually be supplying a custom merge function that produces the final result. You could do it mid-flow, but doing it in that one place guarantees that you always see everything you produced and have one final chance to control every detail of the result.

-- Scott