Getting IdP attributes from proxy IdP

[Cantor, Scott]

> as long as the SP does not ask for a specific AuthnContext (my weight map
> makes the IdP prefer to send our umn-URL over REFEDS). 

Weighting has no impact when an SP requests something, the only possible response then is a match or an error.

> If asked for a specific context, the IdP throws a NoAuthnContext error and
> logs indicate that none of the authn flows matched.

If it's running the flow you expect, then the problem is what you're populating in the result and since you're presumably using that hook you asked about to decide what to populate, obviously if that doesn't take into consideration what the SP asked for, it will fail.

OTOH, you can't just tell it what it wants to hear. If you can't meet the requirement, then failure is the expected outcome.

Using hooks to dynamically populate the Subject implies that one is not auto-populating anything based on any other configuration.

-- Scott