injecting and later consuming <saml:Subject>

[Cantor, Scott]

> The subject would contain a "token" (nonce) that the IdP would
> use to call out to a "system of record" and verify that yes,
> we want an account created for that identifier.

Hmm, ok. You could, if you wanted, do some of that in a custom c14n flow that the IdP's going to run to reverse the Subject, and you're going to have to do *something* there because if the IdP can't reverse it, it's going to fail the request before you get a chance to do anything.

> I guess I would use the c14n layer to later "clean up" the
> subject (remove the token part).

There are two c14n types (presently), SAML and post-login. If you don't plug something in for the SAML one, it will fail.

> I probably don't even need a modified Password flow--I can
> just call Password as a sub-flow. Maybe. Have to think about
> it more.

Right, which is why I was thinking maybe you just do the account creation as a c14n flow up front.

-- Scott