When does the _idp_authn_lc_key get set with ExternalAuthn?

[snekse]

Sorry if these are stupid questions.  I'm blaming it on a less than optimal
setup.

1. When does the  _idp_authn_lc_key cookie normally get set in
ExternalAuthn flow if the user needs to login?

2. Can I force it to be set before a servlet redirect?

3. Is there a way I can utilize Shibboleth to do a redirect instead of a
raw servlet sendRedirect?

BACKGROUND
We're doing External Authentication via a servlet.  If the servlet
determines that the user is not authenticated and needs to login again, I
need to display a login page.  The problem is our login page and logic
exist in another application, so I'm trying to re-direct to that
applications login page. (Q: "Then how does your servlet know if the user
is authenticated?" A: "Dark magic via domain cookies and databases calls")

Here is the flow

www/login
       [User logs in]
www/home
       [User clicks link]
IdP/unsolicited?providerId=sp.example&relayState=www.example.com/dashboard
       [ IdP eventually redirects to our servlet]
IdP/authn/external/SHSession (this is our servlet path)
      [Authn fails, redirect to external app login page] !!! This is where
I need  _idp_authn_lc_key cookie set !!!
      [Note: Currently using req.sendRedirect - is there a better way?]
www/login?whenDone=IdP/authn/external/SHSession (Guessing here)
      [User logs in and is redirected to whenDone]
      [Note: If needed, whenDone could be orig IdP Unsolicited URL]
IdP/authn/external/SHSession
      [Authentication passes, call returnToAuthenticationEngine]
IdP/AuthEngine
     [Eventual return to profile to get relayState]
...  [A bunch of redirects later...]
www.example.com/dashboard
    [User is happy]
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140731/02635ca2/attachment.html