Event transition issue for IdP 3.3.1

[Cantor, Scott]

> If I do an intercept( and I think you have actually provided an example config
> for this, conf/intercept/expiring-password-intercept-config.xml), the caveat
> is I will likely have to define password policy at the IdP with calendar-math,
> instead of utilizing the account-state indicator from the LDAP bind
> response(where we believe password policy should be applied)...  or can I
> access the bind response and the AccountState object within, from the
> interceptor flow?  I'll have to poke around for that option first.

No, but you could maybe poke something into the tree with a pretty minimal expression in webflow and just signal proceed, and defer the rest until an interceptor checks for the thing in the tree.

I guess the hassle is that the "clean" way to put something into the tree is defining a new Java class. This is why I think it's really nice to have a simple maven extension project (I have idp3-osu-ext) that I can throw Java classes in as needed.

I think another way to do it is just to leverage webflow state. If you stick in a flowScope variable set to something, I believe that persists across the whole flow execution and into subflows, so an interceptor can get at it as a signal.

Basically, I'm advocating leaving the conditions part as minimal as possible *if* the goal is to do work that can be done after authentication succeeds.

-- Scott