Can an intercept trigger a re-resolution of attributes?

[Christopher Bongaarts]

I'm not necessarily going with this method long term, but it seemed like 
it might be a simpler path...

We implemented a post-auth intercept for our concept of "expired 
password" (though in our case it's more like what others call "expiring" 
or "grace period").  When a user has the relevant LDAP attribute set to 
the expired password value(s) (via a RegexAttributePredicate similar to 
the SimpleAttributePredicate, hoping to contribute this at some point), 
they are direct to a "your password has expired, go change it" view.  
The password change opens in another window, so when the user is done 
changing password, they could go back to the expired password view page 
and click a "Continue" button/link.  The problem I've bumped into is 
that simply transitioning from the expired password view to the 
beginning of our intercept flow (where it checks the password status 
LDAP attribute) does not pick up any changes to the LDAP entry.

Is there a way to trigger re-resolution of (perhaps specific) attributes 
during an intercept flow?  Either as a flow action, or directing to 
another flow somehow?

If it's not possible, I suspect we'll have to pull the password status 
check into the actual login flow somehow.  I'm having trouble figuring 
out where the "pre-resolution" of attributes is happening, though.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%