Best way to use existing beans in combined flow

[Cantor, Scott]

On 8/25/15, 5:24 AM, "dev on behalf of Daniel Lutz" <dev-bounces at shibboleth.net on behalf of daniel.lutz at switch.ch> wrote:

>In our upcoming implementation for SPNEGO/Kerberos, one flow is a
>combined login flow for username/password login or SPNEGO/Kerberos login
>through a single web page.

Note that David Langenberg was successfully able to invoke the Password subflow directly from within a second flow without much hassle, so it may be that you can do that to combine the flows, depending on the UI.

>This worked so far. But I'm not sure whether this is the right way to
>do it.

In the general case, no, because all of that is implementation detail and is not part of the API. So if this were expected to be a third party extension long term, that would definitely be bad, we'd potentially break it on any update, even just a patch.

But since the plan is to incorporate this into the IdP, that's not really a problem, we can share our own implementation classes freely. So only because of that, I would say it's fine for now.

But if you have any plans to actually ship this independently, no, that would be bad. You can't depend on any non-API material. You would have no choice but to duplicate everything, and not just inherit.

That's one reason directly calling the Password subflow might be a better design.

-- Scott