Obtaining IDP attributes, which method is appropriate?

[Cantor, Scott]

> In the authn/MFA transition map example script I see that you drill down like
> this:

That isn't getting attributes, that's resolving them in the first place. They don't end up in an AttributeContext because it's not a standard resolution sequence done by the core code.

> Is the former method necessary for authn/MFA because authentication has not
> completed?

Because attributes haven't been resolved, but yes.

> Does the latter method work only after authentication has completed?

After attributes have been resolved.

> Can post authentication intercept scripts also use this method?

Post-authentication is also after attributes are resolved.

-- Scott