Logging Untrusted Providers

[Cantor, Scott]

On 7/1/14, 8:06 PM, "Nate Klingenstein" <ndk at internet2.edu> wrote:
>
>Okay.  I'll try to figure out something because I'd like to be able to
>exercise the LDAP login handler.  Thanks a lot for the verification and
>pointers on where to look.

Basically there are, mostly, no redirects to different URLs. When you run
a profile, you're hitting a registered flow definition at some path, and
every time the flow renders a view, it generates a callback to itself by
attaching execution=key to the query string to recover the flow state and
resume it. That's how it handles frames conversationally, every frame has
its own flow key and its own execution state, even if there's one Java
session cookie.

In theory I imagine it's possible to submit the flow key in a form
parameter, but since it behaves this way by default and expects us to
populate the form action with its predefined variable, I assume all
browsers handle form POST with a query string inside the action. But I do
not expect all non-browser tools do.

-- Scott