IDP3 External Authentication Attributes

[Eric Hattemer]

So in IDP2, we have a servlet class that grabs a bunch of oAuth values
and sticks them in the response as an extended Principal.  Then we
create attributes in attribute-resolver.xml using Scripts that pull out
the values from the requestContext.

What's an appropriate way to do this in IDP3 (preferably 3.2.1, since I
need to get this done soon and 3.3 doesn't seem to exist).  I'm looking
over
https://wiki.shibboleth.net/confluence/display/IDP30/ScriptedAttributeDefinition
and all it does is remind me that I have no idea of what I'm doing. 
Like it tells me maybe I should be "navigating the context tree", but I
have no idea after I call
ExternalAuthentication.finishExternalAuthentication() in the servlet
with a subject/principal in the request, where I'll ever see that
subject/principal again.

I'd like to upgrade from IDP2 to 3 with just a few changes.  I probably
should convert this oAuth thing into a flow, but I'd rather worry about
that someday after I figure out what a "flow" actually is.  Right now it
seems hopelessly complicated to me.

-Eric Hattemer