CallExtendedFlow for Custom Password Help Flow

[Cantor, Scott]

> I guess I could make that work with some re-entrant MFA transitions, but it
> really feels more natural to branch off the password flow.

If it's natural to you, that's all that matters. It felt a bit off to me since it also assumes that the flow you're calling is an actual login flow, whereas MFA can knit together flows that aren't formally defined that way, so it's more open to other scenarios. That's why it has all the awkward settings for overriding principals and all that stuff, which all goes away with the MFA variant.

> Good news is that I got it working exactly like I wanted with password
> extended flows. Here's a diff of the config changes I made to get it working:
> 
> https://gist.github.com/serac/4429c75af127b442c919b2ad99d53f9c
> 
> It's worth noting that I had to have my subflow terminate with a
> DisplayUsernamePasswordPage end state to return control to the login form
> when the subflow completed.

That's the kind of thing I figured you'd have to do to make it work. The point there is that you're interfacing with the Password flow in a fairly low-level way that isn't a formal API, at least to some degree. Some of that is a little unclear since the Password flow has those condition hooks, but when you're branching to internal action states, that starts to create coupling beyond the point that was intended.

-- Scott