Deny access to RP based on Kerberos Realm

[Cantor, Scott]

> Should this be done with an activation condition, or
> configured in the MFA login flow? I have implemented the
> chaining of multiple Kerberos validators as described in this
> guide 

Really depends what user experience you want from it. You could slap activation condition in lots of different spots but that's fundamentally a way to largely silently "not do somethiing" based on those criteria, so the user probably gets an authentication failure.

An authorization decision sort of thing is handled by the context check interceptor, which is outside/after all of that stuff and is a more deliberate/direct way to allow creation of events/messages in response to the relevant inputs.

Vermont is a member, so I will send you something offline to see about getting people access to the support systems, that's a better place to get into more specifics or talk about examples.

-- Scott