With the extensive information coming back in the DuoOIDC, I think it would be good to have a generic result handling hook of some kind that isn't dependent on wanting to override the principal set. Basically a side-effect machine, so probably Consumer<ProfileRequestContext>. We don't have a set of objects for scripting Consumer yet but I probably will do them.
The main value I think is logging, so having separate hooks for success/failure would be nice.
I'm mainly thinking about the process log, but I'm not sure if we have an audit log field step before the response token would be cleaned up either, so it would work for adding audit fields in a pinch. I can probably take a shot at this, I just wanted to get it filed.