Thoughts about authentication method / workflow mapping

[Marvin Addison]

> Working on the class that models authentication "workflows" which maps more or less to the V2 concept of a login handler, and thinking about all the problems we've had

I wonder if you could explain or cite some references for the need to
support multiple active authentication workflows in a single
authentication context. I imagine that design is attempting to solve
some of the problems you're referring to, but I can't imagine what
they are off the top of my head.

> Then I thought we could expose information on the AuthenticationWorkflowDescriptor class API about what java.security.Principal information a workflow can produce, to support figuring out what workflows can be used.

Sounds good to me. This is conceptually similar to what has worked
very well with CAS in the authentication components. It's proven
straightforward, flexible, and extensible.

I see some mixing of vocabulary that you might want to consider:

@Nonnull private Subject supportedPrincipals;

That seems to equate subject and principal, where in terms of the
java.security APIs it's a parent/child relationship; a subject has one
or more principals bound to it. It's fine if you want to put a stake
in the ground and call them equivalent in the context of IdP APIs but
it may cause some friction.

M