Inter-Flow Signaling: switching back and forth between authentication flows

[Cantor, Scott]

On 3/31/15, 3:02 PM, "Daniel Lutz" <daniel.lutz at switch.ch> wrote:
>
>(I actually already considered this renaming. At the beginning,
>I just decided to call it "SpnegoKerberos", since we focus on
>supporting Kerberos and don't have plans to support NTLM.
>Support for NTLM or other mechanisms might be added in the future.)

I'm not familiar with the details enough, but certainly if it physically doesn't work for NTLM, including Kerberos in the name makes sense for now.

>Might you give me a hint how I can wire it directly to the flow name
>as the event, and where I should do this?
>(I'm not yet familiar enough to see how this is done.)
>Would I do this somehow in the flow definition (e.g. spnego-authn-flow.xml)
>or somewhere in the servlet?

I was talking about from a view page. If you had to do it programatically, it's a flow definition issue, you have to break the work up into action beans and use our APIs to handle event signaling. You can't do it from a servlet ever, a servlet can't run in the context of a webflow.

>In my current approach, my servlet uses the ExternalAuthentication
>class to indicate the "NoCredentials" error (by setting the request
>attribute ExternalAuthentication.AUTHENTICATION_ERROR_KEY). Then, my
>ClassifiedMessageMap maps "NoCredentials" to "authn/Password".

That would be fine, I didn't realize you meant from a servlet. I thought you were talking about trying to turn it into a webflow. That would not allow for a servlet-based approach.

But you could also just explicitly throw an error of authn/Password and map that to "itself". Just depends what you want to do.

>In case the flow "authn/SPNEGO" is signaled from the login form of the
>flow "authn/Password" (e.g. through a button passing the parameter
>"_eventId_authn/SPNEGO"), the flow "authn/Password" seems to be marked
>as incomplete and moved to the intermediate set. This means that
>"ReselectFlow" would not select it again. (That's the reason that I
>currently manually select the "authn/Password" flow.)

Yes, that's probably true. In effect you've bailed out of it, so if you want to get back to it, being explicit is probably the right way.

>Is there a possibility to re-activate the flow "authn/Password" again
>in this case, so that "ReselectFlow" will select it again?
>(Actually, the flow "authn/Password" hasn't failed in this case,
>it has just not finished.)

Well, you could probably just manipulate the context object to remove it from that collection of attempted flows if you wanted. But it's probably cleaner to just call the flow directly rather than try and depend on the way the code happens to be working right now. There's only so much semantic you can attach to the fields of the context (which are a public API) vs. how it's being used by the engine (which is not).

-- Scott