intercept flow detect first authentication

[Cantor, Scott]

> Logging showed that the authentication result was always
> contained in the active results whether it was a
> first-authentication flow or a SSO flow later.

Hmm, that's not what I would expect, I don't know how it would get there. Unless you're messing with that initial-authn mess, which will cause me to begin retching.

If not, let me know and I'll take a look.

> Instead I am now taking the authentication result and looking
> at its authenticationInstant and lastActivityInstant fields.
> 
> During a first-authentication flow they differ by "not much"
> (less than 5 seconds).
> 
> During a later SSO flow they differ by more than 5 seconds.
> 
> Any thoughts on that approach?

It was the obvious "hack" to use as a fallback, but I was pretty sure it wouldn't be necessary. I can't think of how the result could get added to that list when it wasn't active to start with.

-- Scott