injecting and later consuming <saml:Subject>

[Scott Koranda]

Hello,

First please consider the Shibboleth SP. Suppose that for each SAML2
SSO flow I want to create an  <AuthnRequest> that
contains a unique <saml:Subject> element.

With version 2.6 it appears that the 'template' NativeSP
Session Creation parameter for the /Shibboleth.sso/Login
session initiator mechanism will allow me to do that. Correct?

Next please consider the Shibboleth IdP 3.2.x. Suppose that I
want to create a custom Password flow, modified from the
default flow, that is able to inspect the <AuthnRequest>,
determine if a <saml:Subject> exists, and then perform some
special actions if it does exist. 

Will my custom Password flow have "easy" access to the
<AuthnRequest> and be able to inspect it for the
<saml:Subject>? By "easy" here I mean that I can write
"reasonable" amounts of Java code and get the subject.

Thanks for your consideration. Note that I am considering a
specific and somewhat unique use case--not your ordinary
higher education SAML flow. I am trying to estimate how much
work I will have to gin up a solution.

Thanks,

Scott K