MFA enhancements in 3.3

[Cantor, Scott]

> This part seems key and I'm having trouble imagining how the configuration
> will be clear and straightforward. What we have today is powerful but
> complex, and I'm hopeful we can move to something equally powerful but
> simpler to configure for non-trivial cases.

I think it will be. It basically will run a bean after each stage is done successfully to decide what to do next, and that action will use some Predicates and Functions to decide:

- am I done? If so, wrap it up.
- If I'm not done, what flow do I run next?
- If I am done, how do I combine all the results produced into one final Subject?

Each of those (except the middle one) have reasonable defaults that should work for a lot of use cases. So all you really need is to tell it to run flow B after flow A.

Concretely, I think my personal Duo/Password combo here would maybe be something like this:

    <util:map id="shibboleth.authn.MFA.TransitionMap">
        <entry key="start">
            <bean parent="shibboleth.authn.MFA.Transition"
                p:nextFlow="authn/Password" />
        </entry>
        <entry key="authn/Password">
            <bean parent="shibboleth.authn.MFA.Transition"
	 p:nextFlow="authn/Duo" />
        </entry>
    </util:map>

I think that's reasonably simple. I might come up with a better syntax for it than a map, I don't know yet, suggestions welcome.

Underneath, that Transition class has slots for functions/predicates that ca make it much more complex, you just don't use them if you don't need it.

Note that you don't have to pass control directly from one login flow to another. There could be intermediate flows provided by you that do other work (e.g. attribute lookup), and I'll have at least that use case provided with a built-in mini-flow that does that.

Yes, I'm basically reinventing some of webflow. I think that's about the only way to achieve the middle ground we're after between needing a full custom web flow for everything, or tackling as much as possible out of the box.

> No code or flows sounds awesome. I'm willing to try to adapt out Duo flow to
> this design once it gets in alpha or beta so we can kick the tires a bit with a
> concrete implementation.

I'll have a version checked in by then you should be able to adapt I think.

Unfortunately I got interrupted in my progress by some other stuff, so hopefully it won't be long before I'm back to it since I was rolling pretty well.

-- Scott