<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0" /> <base href="https://issues.shibboleth.net/jira" />
<title>Message Title</title>
</head>
<body class="jira" style="color: #333; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.429">
<table id="background-table" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; background-color: #f5f5f5; border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<!-- header here -->
<tr>
<td id="header-pattern-container" style="padding: 0px; border-collapse: collapse; padding: 10px 20px">
<table id="header-pattern" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tr>
<td id="header-avatar-image-container" valign="top" style="padding: 0px; border-collapse: collapse; vertical-align: top; width: 32px; padding-right: 8px"> <img id="header-avatar-image" class="image_fix" src="cid:jira-generated-image-avatar-pdmzksxvevxglxd46rh3hlrjhpi=@https://aai-logon.switch.ch/idp/shibboleth-17d5fd10-33d8-47d4-9ef9-d982ac112f1f" height="32" width="32" border="0" style="border-radius: 3px; vertical-align: top" />
</td>
<td id="header-text-container" valign="middle" style="padding: 0px; border-collapse: collapse; vertical-align: middle; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px"> <a class="user-hover" rel="pdmzksxvevxglxd46rh3hlrjhpi=@https://aai-logon.switch.ch/idp/shibboleth" id="email_pdmzksxvevxglxd46rh3hlrjhpi=@https://aai-logon.switch.ch/idp/shibboleth" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=pdmzksxvevxglxd46rh3hlrjhpi%3D%40https%3A%2F%2Faai-logon.switch.ch%2Fidp%2Fshibboleth" style="color:#3b73af;; color: #3b73af; text-decoration: none">Daniel Lutz</a> <strong>commented</strong> on <a href="https://issues.shibboleth.net/jira/browse/IDP-821" style="color: #3b73af; text-decoration: none"><img src="cid:jira-generated-image-static-subtask_alternate-a64fc5a4-a90b-4252-a434-b638487edee7" height="16" width="16" border="0" align="absmiddle" alt="Sub-task" /> IDP-821</a>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td id="email-content-container" style="padding: 0px; border-collapse: collapse; padding: 0 20px">
<table id="email-content-table" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; border-spacing: 0; border-collapse: separate">
<tr>
<!-- there needs to be content in the cell for it to render in some clients -->
<td class="email-content-rounded-top mobile-expand" style="padding: 0px; border-collapse: collapse; color: #fff; padding: 0 15px 0 16px; height: 15px; background-color: #fff; border-left: 1px solid #ccc; border-top: 1px solid #ccc; border-right: 1px solid #ccc; border-bottom: 0; border-top-right-radius: 5px; border-top-left-radius: 5px; height: 10px; line-height: 10px; padding: 0 15px 0 16px; mso-line-height-rule: exactly">
</td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0px; border-collapse: collapse; border-left: 1px solid #ccc; border-right: 1px solid #ccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #fff">
<table class="page-title-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tr>
<td style="vertical-align: top;; padding: 0px; border-collapse: collapse; padding-right: 5px; font-size: 20px; line-height: 30px; mso-line-height-rule: exactly" class="page-title-pattern-header-container"> <span class="page-title-pattern-header" style="font-family: Arial, sans-serif; padding: 0; font-size: 20px; line-height: 30px; mso-text-raise: 2px; mso-line-height-rule: exactly; vertical-align: middle"> <a href="https://issues.shibboleth.net/jira/browse/IDP-821" style="color: #3b73af; text-decoration: none">Re: Explore extensibility of password flow to support "enhanced" login methods</a> </span>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td id="text-paragraph-pattern-top" class="email-content-main mobile-expand comment-top-pattern" style="padding: 0px; border-collapse: collapse; border-left: 1px solid #ccc; border-right: 1px solid #ccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #fff; border-bottom: none; padding-bottom: 0">
<table class="text-paragraph-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 2px">
<tr>
<td class="text-paragraph-pattern-container mobile-resize-text " style="padding: 0px; border-collapse: collapse; padding: 0 0 10px 0">
<p style="margin: 10px 0 0 0">I tested this for the SPNEGO and X509 flows and like to share my experiences here.<br /> This solution looks quite good. Switching back and forth between the Password login flow and the subflows works well.</p>
<p style="margin: 10px 0 0 0">While testing, I encountered the following issues and missing functionality:</p>
<ul>
<li>
The user should have the possibility to enable autologin for future logins, by enabling an appropriate checkbox. Thus we need a possibility to pass specific user input from the UI to the called subflow. (The deployer may adapt the login.vm template as required. But this requires support from the webflow to pass such information to the subflows, I think.)
<ul>
<li>
In the case of SPNEGO, at least an autologin checkbox would be required as such input. The corresponding parameter may be named "_shib_idp_SPNEGO_autologin". (Do you see a generic possibility to allow to pass through arbitary parameters from the UI to the called subflow?)
</li>
<li>
Similarly, in case of X509, the user should get the chance to enable the option "x509passthrough". (The current implementation of the X509 allows to use an optional JSP page to allow the user to enable passhthrough. Integrating this in the Password login page may be more convenient.)
</li>
</ul>
</li>
<li>
I realized that the current implementation requires that the subflows are declared at both places, in the property "idp.flows" in conf/idp.properties and in the bean "shibboleth.authn.Password.ExtendedFlows" in conf/authn/password-authn-config.xml. In the case where the subflows are declared before the "authn/Password" login flow in conf/authn/general-authn.xml, the subflows would be run as normal login flows before the Password flow is run. I think that a deployer should have the possibility to configure this independently.
</li>
<li>
A login flow that may be called as a subflow from the Password flow should have the possibility to decide whether it has been called as a standalone flow (i.e. directly called from the "authn" flow) or it has been called as a subflow from the Password flow. In the usual deployment of the SPNEGO login flow, SPNEGO should directly be run if autologin is enabled. In this case, the Password flow should not be run at all if SPNEGO succeds. If autologin is not enabled, the Password login flow should be run, and SPNEGO should be offered as an option. If the user chooses SPNEGO in this case, SPNEGO should be run unconditionally (independently of the state of autologin).
<ul>
<li>
Do you see a clean solution how this can be solved? One idea I have is to allow a deployer to configure an "autorun condition" based on a scripted predicate. This would require that the script can get the information whether the flow was called from the Password flow or not.
</li>
</ul>
</li>
</ul>
<p style="margin: 10px 0 0 0">Further comments:</p>
<ul>
<li>
The error messages (template login-error.vm) should always be shown, independent of the state of $passwordEnabled.
</li>
<li>
Similar for revoking the consent: As long as a user interface is shown at all, the option to revoke consent should be shown. (In case autologin for SPNEGO is enabled and no user interface is shown, this option can't be made available. That's OK, I think.)
</li>
</ul>
<p style="margin: 10px 0 0 0">I have attached a diagram (IdPV3_SPNEGO_X509_combined_with_Password.pdf) showing the various possible/expected flows in the described scenario (SPNEGO/X509/Password). It shows the case where the flows are configured in the order (authn/SPNEGO, authn/X509, authn/Password), and the flows authn/SPNEGO and authn/X509 are callable from the authn/Passord flow.</p>
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0px; border-collapse: collapse; border-left: 1px solid #ccc; border-right: 1px solid #ccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #fff">
<table id="actions-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px">
<tr>
<td id="actions-pattern-container" valign="middle" style="padding: 0px; border-collapse: collapse; padding: 10px 0 10px 24px; vertical-align: middle; padding-left: 0">
<table align="left" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tr>
<td class="actions-pattern-action-icon-container" style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 0px; vertical-align: middle"> <a href="https://issues.shibboleth.net/jira/browse/IDP-821#add-comment" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none"> <img class="actions-pattern-action-icon-image" src="cid:jira-generated-image-static-comment-icon-696e2753-d702-470e-822f-28f759d64fc5" alt="Add Comment" title="Add Comment" height="16" width="16" border="0" style="vertical-align: middle" /> </a>
</td>
<td class="actions-pattern-action-text-container" style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 4px; padding-left: 5px"> <a href="https://issues.shibboleth.net/jira/browse/IDP-821#add-comment" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none">Add Comment</a>
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
<!-- there needs to be content in the cell for it to render in some clients -->
<tr>
<td class="email-content-rounded-bottom mobile-expand" style="padding: 0px; border-collapse: collapse; color: #fff; padding: 0 15px 0 16px; height: 5px; line-height: 5px; background-color: #fff; border-top: 0; border-left: 1px solid #ccc; border-bottom: 1px solid #ccc; border-right: 1px solid #ccc; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; mso-line-height-rule: exactly">
</td>
</tr>
</table>
</td>
</tr>
<tr>
<td id="footer-pattern" style="padding: 0px; border-collapse: collapse; padding: 12px 20px">
<table id="footer-pattern-container" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tr>
<td id="footer-pattern-text" class="mobile-resize-text" width="100%" style="padding: 0px; border-collapse: collapse; color: #999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px">
This message was sent by Atlassian JIRA <span id="footer-build-information">(v6.4.1#64016-<span title="5d7581434f35c063b7031942e62ed4d72a97fa9c" data-commit-id="5d7581434f35c063b7031942e62ed4d72a97fa9c}">sha1:5d75814</span>)</span>
</td>
<td id="footer-pattern-logo-desktop-container" valign="top" style="padding: 0px; border-collapse: collapse; padding-left: 20px; vertical-align: top">
<table style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tr>
<td id="footer-pattern-logo-desktop-padding" style="padding: 0px; border-collapse: collapse; padding-top: 3px"> <img id="footer-pattern-logo-desktop" src="cid:jira-generated-image-static-footer-desktop-logo-8c0bea08-5caf-4471-9dca-b69abab00f28" alt="Atlassian logo" title="Atlassian logo" width="169" height="36" class="image_fix" />
</td>
</tr>
</table>
</td>
</tr>
</table>
</td>
</tr>
</table>
</body>
</html>