Best practice MFA IdP3.3.1

[Cantor, Scott]

> Well, now I am in a pickle...  My intention was to add a "scratch" context to
> the tree for the attribute-filter to access in a policy rule script.  I was unaware
> that the attribute-filter process runs BEFORE the profile actions which
> identify and run my postAuthenticationFlow interceptor, which does the
> context tree addition.  Is there a way to re-run the attribute-filter process
> from the interceptor, or am I left with the only option I see, which is to drill
> into and manipulate the attribute context from the interceptor, and then just
> proceed?

You *could* re-run it. I don't think anybody has, and I'm not sure in the end it wouldn't be just as simple to go groveling yourself, it probably depends on the complexity of the rules you want to apply.

The main issue is just that I haven't supplied any "shortcuts" for running the filtering engine from a script like I eventually did for the resolver, but if you're doing a webflow definition anyway, what you would pretty much have to do is wire in a call to the FilterAttributes action class like our own flows do.

I believe it sets up the AttributeFilterContext to run with and then does all the work.

It's one of those things that sort of demands a certain amount of either trust or investigating to see that it's doing the right thing, whereas just directly screwing with the AttributeContext is certainly "safer" in the sense that you know exactly what you're getting rid of.

-- Scott