new intercept flow

[Tom Zeller]

>> Is it possible to access the principalName as an attribute in a flow w/o
>> creating an AttributeDefinition?
>
> I don't think so using the SimpleAttributePredicate. I believe there
> is another predicate that will, I'll look ...

Well, I don't know.

The principal name should be retrievable via the
shibboleth.PrincipalNameLookup.Subject and
shibboleth.ChildLookup.SubjectContext functions, see
system/conf/audit-system.xml for examples of audit logging the
username, which would then need to be passed to a predicate.