Best practice MFA IdP3.3.1

[O'Dowd, Josh]

> That's just not workable, so what I could probably say you need to do is resolve whatever "policy inputs" you need for this, and then create an interceptor that runs for the SPs needed and examines the policy data so it knows what to ask or whether to ask.

Trying to follow...  Will the interceptor run(as a postAuthenticationFlow) regardless of an existing Authn result(SSO session)?  If yes, I should do the prompting and attribute resolve prep from the interceptor instead of from MFA.

Josh