Ex: Re: attribute access in duo velocity template

[Paul B. Henson]

> From: Cantor, Scott
> Sent: Tuesday, April 6, 2021 6:50 PM
> 
> It's for things like OpenID's request field with the user's name, so strictly
> speaking you could be overwriting it if you were using a protocol that
> populates it. I don't recall if the code is doing anything with it, or just filling it
> in.

We're not currently using OIDC; it looks like the only use of this in the base idp code is in ExtractActiveAuthenticationResults.java:

        if (authenticationContext.getHintedName() == null) {
            authenticationContext.setHintedName(session.getPrincipalName());
        }

Like I said, it might not have been the cleanest way to do it, but it satisfied the "can you do this by tomorrow" constraint <sigh>. I'm hoping this is just temporary for the rollout, if it turns out to be a permanent requirement I guess I will try to implement something different, as we probably will eventually use OIDC. Maybe call getAuthenticationStateMap() and stash stuff in there to communicate between the MFA script and the velocity template?