intercept flow detect first authentication

[Scott Koranda]

> > So could I simply call getInitialAuthenticationResult() on the
> > authentication context and if a result is returned I know this
> > is not SSO?
> 
> If it did SSO, it wouldn't have done initial-authn since the
> user was already identified. So yes, I think so.
>  

For the archive:

If the IdPv3 is using initial authentication then a bean like
this can be used as an activation condition on an intercept
flow if the flow should only fire during "first
authentication" and not during SSO flows:

<bean id="_ShouldCheckPasswordExpiration" parent="shibboleth.Conditions.Scripted" factory-method="inlineScript">
    <constructor-arg>
        <value>
<![CDATA[
        logger = Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.profile.logic.ScriptedPredicate");
        logger.debug("Entered bean _ShouldCheckPasswordExpiration");

        check = false;
        authCtx = profileContext.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
        if (authCtx != null) {
            initialAuthResult = authCtx.getInitialAuthenticationResult();
            logger.debug("initial authentication result is {}", initialAuthResult);
            if (initialAuthResult != null) {
                flowId = initialAuthResult.getAuthenticationFlowId();
                logger.debug("flow is {}", flowId);
                if (flowId == 'authn/Password') {
                    logger.debug("Initial authentication by password so check password expiration");
                    check = true;
                }
            }
        }

        if (!check) {
            logger.debug("Do not check for password expiration");
        }

        check;
]]>
        </value>
    </constructor-arg>
</bean>

Scott C I did see the new intercept flow you checked in for 3.3 that checks
for password expiration. It cannot be used in this use case for somewhat
esoteric reasons but the implementation I am using is much the same.

Thanks,

Scott K