Send an attribute based on event in the MFA flow

[Scott Cantor]

The proper way to signal to a SAML SP anything about authentication is in the AuthnContext, so personally I would not aceede to such a request. Attributes are about a subject, not about a transaction, so it's a misuse of the standard.

Having said that, you can do anything you want, in dozens of different ways.

Putting something inside the authenticated Subject is the preferred way to do something related to authentication, after which a Subject-based data connector or attribute definition can be used to do something with it in the resolver.

Getting something into the Subject specific to the MFA scripting layer is generally handled with a custom merging function applied to construct the final merged Subject from all the individual results.

Some login flows have more dedicated ways to customize the Subject they produce, which would avoid the need for a custom merging function at the end.

That's the most formally correct way.

The hack would be to stuff something via the MFA script into a ScratchContext, an OpenSAML class wrapping a map that can be added to the context tree for the request, like under the PRC or whereever, and suck it back out in a ScriptedAttribute.

-- Scott