User Defined Flows Problem

[Cantor, Scott]

On 7/21/14, 1:07 PM, "Marvin Addison" <marvin.addison at gmail.com> wrote:

>My hypothesis is that user flows cannot call into system flows since
>they are defined in distinct flow registries. While there is a
>parent-child relationship between user and system flows, there are two
>registries.

Yeah, you're right. I didn't think about the implications on extensions,
but I discovered this when I defined the parent/child relationship and was
creating the user exits. I knew that I couldn't overlay flows in system/
with a user flow, but I didn't think about the need to directly call them,
which is primarly in the authentication case.

The problem is that when a parent registry flow tries to call a subflow,
it only looks in the parent, and doesn't start at the "top" of the tree
and call into the child. I happen to think that's a bug, but be that as it
may...

>I'm thinking this is a case of first-one-wins where the
>user-defined flow is pulled from the userFlowRegistry bean where no
>authn flow is defined.

It's more like "containment". If you're inside the child, it does what
you'd expect, and falls into the parent. But not the other way.

>While reproducing the behavior is not proof of my hypothesis, I hope
>it's helpful in describing the problem. As far as workarounds, I tried
>definining a single registry that used %{idp.home} as the base-path,
>but that messed up the flow identifiers for user-defined flows (extra
>"flow/" prefix in ID).

True, but then again, I don't much care what they are called. Also, I
didn't really explore collapsing things into one registry that had a base
path but also defines some well-defined ones. If that works, that may be
good enough here.

I can try that.

> I simply don't see a way to do this with
>built-in components that preserves the clean flow identifiers in use
>at present. If there is indeed a real problem here, I fear a custom
>FlowRegistry that supports multiple basePaths will be required.

The other option is to move the authn flows into user space, but I don't
love that either.

-- Scott