How to implement SPNEGO as web flow for IdP V3

[Daniel Lutz]

I'm trying to implement the SPNEGO negotiation for Kerberos
as a web flow for the IdP V3. As I'm not yet familiar with
Spring Web Flow and the authentication flows of the IdP V3,
it's not clear to me how I can do this, and I would appreciate
some help.

The SPNEGO negotiation consists of a sequence of multiple
HTTP request/response pairs between the client (browser)
and the server (IdP), where some data is exchanged in the
"WWW-Authenticate" header. The server usually responses
with an HTTP 401 "Unauthorized" status, except for the last
response, where the status is HTTP 200 "OK".

According to some of my observations, the IdP creates a
new session for the client quite early, so that this
session is available during the authentication flow
(cookie JSESSIONID). Furthermore, each flow has a
conversation identifier.

I have the following idea how to implement SPNEGO
using SWF:

- The initial action redirects the browser to a specific
  URL that includes the flow's conversation identifier.
- When the browser sends a subsequent request to this
  URL, the actual SPNEGO negotiation begins, i.e. the
  flow sends an HTTP 401 "Unauthorized" status back to
  the browser.
- The session and the flow conversation identifier allow
  to continue the flow.
- At the end of the flow, a Kerberos principal will be
  available (in case no error occured).

This leads me to the following questions:
- How can an SWF state do a redirection?
- How can an SWF state respond with an HTTP 401 "Unauthorized"
  status?
- How does the special URL containing the flow conversation
  identifier need to look like? Is it possible for the IdP
  to select the current flow based on this URL?


Or should I rather implement the SPNEGO logic in a separate
servlet and let the flow do an external authentication
using this servlet, similar as the X509 flow does?

Thank you a lot for some hints.


-- Daniel