Interrupting/branching out of web flows

[Cantor, Scott]

On 11/12/13, 6:15 AM, "Marvin Addison" <marvin.addison at gmail.com> wrote:

>> The problem we have then is getting profile state communicated to
>> something outside the view-state from the client end.
>
>I guess I'm so used to flows pausing at view states that I simply
>can't imagine what you're trying to do. What exactly are you trying to
>communicate with? Another component?

Our external authentication interface in V2 relies on a RequestDispatcher
forwarding to a servlet, JSP, or other resource in the container to "pick
up" the authentication process and do whatever people want it to do, and
then return back to the V2 authentication code. It uses request attributes
to communicate information in and out.

To "port" that capability to V3, I would need to be able to interrupt the
web flow we're processing. From what I can tell, that doesn't work unless
it's done while the flow is paused on the client side in a view-state.

>If you're just trying to stash state to pick up when the flow resumes,
>then that's likely your only option. It's really a non-issue if you
>have data that's compatible with flow storage (i.e. serializable);
>otherwise you have to invent workarounds like accessing the
>HttpSession directly.

No, that's already handled to whatever extent it can be, the issue I'm
thinking about is how to get state information over to the "external"
resource if it can't be done with request attributes.

>I'd be willing if I understood the use case better.

The V2 description of this feature is here:

https://wiki.shibboleth.net/confluence/display/SHIB2/IdPAuthExternal

The purpose of it is to allow more precise behavior than just
getRemoteUser() from an "externalized" authentication source, by having
logic that can actually look at the request in some detail.

What I'm thinking of as a compromise is to require that the "stub" people
suply as a hook for their external process is a view (meaning JSP or
Velocity) template that would run within the web fow per usual. But I
don't know if that's sufficient to reproduce the kinds of things people do
with V2.

-- Scott