3.3 SNAPSHOT: AuthN resolveAttribute not activating authn flow

[Cantor, Scott]

> The problem I see right now is that the step to pull out the
> defaultAuthenticationMethods property is coming too early right now, but I
> should be able to adjust that easily before we freeze. It's sitting right outside
> the authentication subflow call today, so moving it inside should be
> straightforward for SAML and CAS. It just needs to run after the session is
> loaded for the user, and then if SSO is in play, you'll get the chance to
> intervene in the apropriate way.

This is now done in time for the release, so there shouldn't be any limitation on deriving the authentication methods to impose on the fly. "if user identified, resolve attribute, check value, require MFA AuthnContext". Takes maybe 20 lines of script, I should be able to do an example once I get a breather.

-- Scott