An interceptor is an arbitrary subflow that is assigned a flow ID that starts with "intercept/" and is further defined to the system with a bean of type net.shibboleth.idp.profile.interceptor.ProfileInterceptorFlowDescriptor in a list in conf/intercept/profile-intercept.xml.
Interceptor flows must inherit from an abstract flow named "intercept.abstract" by specifying it in the
parent attribute. Failure to do so will prevent the system's built-in event and error handling from functioning correctly.
To enable an interceptor, the flow ID suffix (the name after the "intercept/" prefix) must be added into the appropriate list property on the relevant ProfileConfiguration object in conf/relying-party.xml. The properties contain an ordered list of flow IDs representing the flows to execute in a sequence until one fails (results in a non-"proceed" event) or all have run.