intercept flow detect first authentication

[Scott Koranda]

> > What is the most elegant way for a post-authentication
> > intercept flow to only "fire" after the first authentication
> > and not as part of any future SSO flows?
> 
> I'm not sure there's an elegant way, and my brain's inside
> the SP right this second, but I think you could check to see
> if AuthenticationContext.getAuthenticationResult() is
> contained within
> AuthenticationContext.getActiveResults().valueSet()
> 
> I overrode AuthenticationResult.equals() so that equality is
> based on the flow ID and the authentication timestamp, so
> that should guarantee it's the same act.

I do not think that will work.

Logging showed that the authentication result was always
contained in the active results whether it was a
first-authentication flow or a SSO flow later.

Instead I am now taking the authentication result and looking
at its authenticationInstant and lastActivityInstant fields.

During a first-authentication flow they differ by "not much"
(less than 5 seconds).

During a later SSO flow they differ by more than 5 seconds.

Any thoughts on that approach? 

I realize there are situations where a first-authentication
flow and a SSO flow(s) could happen within 5 seconds--that's
ok for this use case. If the intercept fires on both it is not
a problem for this particular use case.

Thanks,

Scott K