Inter-Flow Signaling: switching back and forth between authentication flows

[Daniel Lutz]

I'm working on an implementation of the SPNEGO/Kerberos authentication
for IdP V3 based on SWF. I implemenented the authentication flow as
an external flow using a helper servlet, similar to the "authn/X509"
flow. My flow is currently called "authn/SpnegoKerberos".

One possible deployment is to allow the manual initiation of the SPNEGO
authentication from the "authn/Password" flow's login page.
I can do this by using inter-flow signaling by triggering the event
"authn/SpnegoKerberos". This will call my flow "authn/SpnegoKerberos".

But in case of a SPNEGO authentication error, the user should get back
to the login page. I could manage this by triggering the event "authn/Password"
(via my flow's ClassifiedMessageMap, by a mapping from "NoCredentials"
to "authn/Password"). This will lead the user back to the login page.

Is this the right way to do it?
That is, can you switch from one authentication flow to another one
as many times as required?
Or would this leave many unfinished flow executions?

Thank you in advance for your comments.

(PS: A further deployment option will be to run the SPNEGO flow
before the Password flow, with a fallthrough to the "authn/Password"
flow. This might even be the only option at the end. But we
still consider to support the option described above.)


-- Daniel