reCaptcha integration with IDPv3

[Cantor, Scott]

> Maybe it's possible to "write a custom flow" by flow-inheritance?

That affords a lot of control, more than I have much experience using. Brent did more of it, I had some trouble making things work initially and avoided using it as much. But the main problem here is that the system flows aren't a public API either, so even though you probably *could* do this and make something work, it's at least as brittle if not more so as what you suggested.

> By the way, I wonder whether the interceptor mechanism is suitable for
> extension in this case.

It depends on the timing you want. If you want to prevent password attempts, it would have to be a separate UI to use the interceptor feature. The only set that run before login time are the ones that are used to run the security policy handlers on the messages. The "normal" more-documented way of using them is after login-time.

-- Scott