ACS URL or maybe post-auth target redirect?

[Cantor, Scott]

You can also interject a session hook that runs before it goes to the target, which is generally a more practical approach.

It just doesn't replace the ACS but it does allow veto rights to the session.

-- Scott