Thoughts about authentication method / workflow mapping

[Cantor, Scott]

> Should have used class names. In reviewing your commits on this work,
> I noted that AuthenticationContext has slots for various kinds of
> workflows. Makes sense. But it was surprising that active workflows is
> a collection:
> 
> @Nonnull @NonnullElements private ImmutableMap<String,
> AuthenticationWorkflowDescriptor> activeWorkflows;

Ok. Short answer is that all of that is fairly in flux as I'm working out how this should work overall from a webflow PoV. It's all tied up into how to handle SSO, disable SSO, etc.

> I'm thinking of AuthenticationContext as something that's relatively
> short-lived; for example, exists just long enough to get the user
> through the authentication process.

It is. It's the state object in the context tree for the authn subsystem/subflows.

> If that's correct I can't imagine
> how you can have more than one active flow. If the context is
> longer-lived, e.g. for the life of the IdP session, then multiple
> active flows makes more sense, but I'm still not certain I understand
> how there would ever be more than one.

That specific thing, which was in the code before I touched it, is because we have a general model of putting information into the context tree in multiple places. So for exampe, information from the Session that the subsystem needs, like the active workflows (if in fact we conclude that), may be copied to the AuthenticationContext.

At this point, I am leaning away from all that flow calculation stuff being in the AuthenticationContext at all, but it's still being fleshed out in my mind and has a ways to go. I have a handle now on why Chad was doing that, and I don't know that I can avoid it, but I'm still working on it.

-- Scott