Check password strength at the MFA level.

[Cantor, Scott]

> idp.authn.Password.retainAsPrivateCredential

You can't remove it if it's retained that way, so:

> idp.authn.Password.removeAfterValidation

If you want to be able to remove it, you'd have to turn that one off and then (optionally) remove it yourself. It also makes it eaier to grab anyway.

> And how do I get the password inside my MFA strategy
> (nashorn).

The UsernamePasswordContext is under the AuthenticationContext in the tree.

-- Scott